--- Begin Message ---
On Dec 22, 2020, at 8:36 AM, Michael Richardson <mcr+i...@sandelman.ca> wrote:
> Guy Harris <g...@alum.mit.edu> wrote:
>
>> And, as per my idea of using 65535 to mean "custom linktype", similar
>> to pcapng custom blocks and options, with either:
>
> I'm happy with this proposal, but isn't it pcapng specific?
No - it's *cleaner* to implement in pcapng, as you can use Interface
Description Block (IDB) options to provide the Private Enterprise Number (PEN)
and an enterprise-specific encapsulation type, but:
if we go with the PEN and and enterprise-specific encapsulation type
with IDB options, for pcap we can steal the former time stamp offset
(Reserved1) and time stamp accuracy (Reserved2) fields, interpreting them as
the PEN and enterprise-specific encapsulation type, respectively, if the link
type is 65535;
if we go with the PEN as an IDB option, and say that if an enterprise
wants more than one encapsulation type, they'd have to put a encapsulation type
at the beginning of the payload, so, for pcap, we'd steal the former time stamp
offset (Reserved1), interpreting it as the PEN if the link type is 65535;
if we go with putting the PEN and encapsulation type at the beginning
of the payload, that would work the same way for pcap as it does for pcapng.
--- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
