On 13 Dec 2011, at 8:35 PM, William A. Rowe Jr. wrote: > A silly question perhaps, but was the tcpdump/wireshark file format > considered? > If not, was there a reason to invent a new representational format? > > It seems like the functionality you describe, at the httpd-internals > visibility, > emitted in a tcpdump-compatible representation, would be a godsend. All the > GUI inspection tools already exist.
It wasn't considered no, we were after something that was very simple, was text based so we could open up a capture file with a text viewer and look at the result without necessarily running it through firehose to demux it. It does sound like a very useful thing to do though. Having looked at the packet format, it seems like all the format types are different layer 2 packets of various kinds, when I'm after something a lot simpler (just request fragments muxed together). Something definitely worth looking into in more depth. Regards, Graham --
