On Jul 19, 2016, at 7:12 AM, Gerard Garcia <ggar...@abra.uab.cat> wrote:
>> 2) What is the format of the transport header? > > It is well described in the virtio vsock specification: > https://stefanha.github.io/virtio/#x1-2800007 May we just link there? If that's struct virtio_vsock_hdr { le64 src_cid; le64 dst_cid; le32 src_port; le32 dst_port; le32 len; le16 type; le16 op; le32 flags; le32 buf_alloc; le32 fwd_cnt; }; that appears to duplicate fields in the link-layer header; are those fields, in fact, duplicates? >> 3) Will the length of the transport header ever change? > > We should assume that it may change. So will the transport header ever change *without* the length changing? If it changes by adding new data to the end, or by removing some fields at the end, code that parses a packet in a capture can use the length field to determine whether the added fields are present, but if the header can change without the length changing - or by more than just fields being added to the end or removed from the end - there needs to be something in the header to give a version for the transport header, such as changing the transport header type. _______________________________________________ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
