On May 12, 2013, at 10:57 PM, Anders Broman <a.broman@xxxxxxxxxxxx> wrote:
> So either this is a bad idea, don't pursue it or everything we can read we should be able to write in pcap-ng
> as a temporary file at least.
...or if we're going to store the contents of packet *not* just generated by gluing together stuff from the capture file (e.g., stuff generated by decompressing packet data or decrypting packet data), we should store it in a temporary file with a format that we control, rather than a capture file format. (Yes, that means that the results of that won't be *saved*, but there's no obligation for us to *avoid* regenerating decompressed/decrypted/etc. packet data.)
I.e., having a capture file format that saves *arbitrary higher level packets* so that we can just read those packets is *NOT* a required goal of this project.
