> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Hannes
> Gredler
> Sent: mercoledi 14 aprile 2004 21.05
> To: [EMAIL PROTECTED]
> Cc: [EMAIL PROTECTED]; Loris Degioanni
> Subject: Re: [tcpdump-workers] Proposed new pcap format
>
>
> On Wed, Apr 14, 2004 at 08:25:25AM +0200, Fulvio Risso wrote:
>
> | I agree with Loris.
> | I know that this flag would be extremely useful, but there are
> no guarantees
> | that you're able to get this info from the NIC / NIC driver.
> | Perhaps, what we should to is to use 2 bits for each flag,
> where the first
> | one means "flag is valid", and the second one it is the flag value.
> | E.g.:
> |
> | 1 0 0 0 . . . . . .
> | ^^^ ^^^ ^^^ ^^^
> | "incoming" flag packet is "outcoming" flag No meaning
> | is valid not "incoming" is NOT valid
>
>
>
> why not assigining simple codepoints for the direction information;
>
> i.e.
>
> 0 ... invalid/undefined/unsupported etc.
> 1 ... incoming
> 2 ... outgoing
Just because "2" requires two bits in binary ;-))
What you say is more or less what I wrote; unfortunately I forgot to say
that the flags string (in the example) is written in binary and every flag
requires two bits ;-))
fulvio
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
