In some email I received from Ronnie Sahlberg, sie wrote: > Oh, I forgot. > > Another useful thing to have is an option for the packet block where one > would store > a reasonably collission-safe 8-byte hash of the packet data. > > This would make it much easier to compare two different capture files to see > where packets are missing etc.
I'll agree that this, as part of the per-packet header, would be a useful addition to the pcap format. No need for chained hashing, just per-record. Darren - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
