On 05/13/2015 11:31 AM, Vadim Kochan wrote:
On Wed, May 13, 2015 at 11:24:11AM +0200, Daniel Borkmann wrote:
On 05/13/2015 11:21 AM, Vadim Kochan wrote:
...
Or in case of Netlink link type enforce to use netsniff-ng pcap format
...
I think that would be rather unexpected as other tools like Wireshark
cannot deal with that afaik. In that case, I rather prefer your patch
here.
Then the patch should be re-worked a little to use cooked header only
for default & nsec header formats, which I forgot to add in
pcap_pkthdr_has_ll func ...
Ok, so changing defaults, I would like to avoid actually as it could
potentially break things like Security Onion and others that rely on
the current capturing format (if they use the default one). It would
also make the pcaps bigger for that case.
Here would be my suggestion on how to move forward: 1) add the cooked
header which is understood by tcpdump/wireshark as a new pcap type, 2)
if we detect we're capturing on a netlink(/nlmon) device, use that as
a default there (I don't think there are many people relying on this
in netlink case), and 3) add a command-line option f.e. --cooked that
would make it easy to use as a shortcut for --magic XYZ.
What do you think?
Thanks,
Daniel
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
