On 2015-05-13 at 11:45:16 +0200, Daniel Borkmann <[email protected]> wrote: > On 05/13/2015 11:31 AM, Vadim Kochan wrote: > >On Wed, May 13, 2015 at 11:24:11AM +0200, Daniel Borkmann wrote: > >>On 05/13/2015 11:21 AM, Vadim Kochan wrote: > >>... > >>>Or in case of Netlink link type enforce to use netsniff-ng pcap format > >>>... > >> > >>I think that would be rather unexpected as other tools like Wireshark > >>cannot deal with that afaik. In that case, I rather prefer your patch > >>here. > > > >Then the patch should be re-worked a little to use cooked header only > >for default & nsec header formats, which I forgot to add in > > > > pcap_pkthdr_has_ll func ... > > > > Ok, so changing defaults, I would like to avoid actually as it could > potentially break things like Security Onion and others that rely on > the current capturing format (if they use the default one). It would > also make the pcaps bigger for that case. > > Here would be my suggestion on how to move forward: 1) add the cooked > header which is understood by tcpdump/wireshark as a new pcap type, 2) > if we detect we're capturing on a netlink(/nlmon) device, use that as > a default there (I don't think there are many people relying on this > in netlink case), and 3) add a command-line option f.e. --cooked that > would make it easy to use as a shortcut for --magic XYZ.
Full ACK. And as an addition may I suggest 4) document the new pcap type and the corresponding new command line option/magic in the manpage. Best Tobias -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
