--- Begin Message ---
On Mon, 2022-05-09 at 08:44 -0400, Michael Richardson wrote:
> A capture from a host to a hub with a mix of downstream devices would
> seem to include transmissions at different speeds.
The problem is only when capturing at full-speed where either the host
or hub is full-speed only (i.e. not high-speed capable) and there is
low-speed device connected to the hub.
I think the corner case is not going to be experienced by majority of
users. The fact that both OpenVizsla and LambdaConcept USB2 Sniffer
fail to capture such links (and there is not even an issue reported at
these projects issue trackers) supports my opinion.
As long as you have high-speed hub and host, the full-speed/low-speed
problem is not going to hit you.
> PCAP format can not mix LINKTYPES in the same file.
> That is the *major* feature that pcapng has.
> tcpdump/libpcap can't write pcapng files *yet*, and it would seem
> that you'd
> need that if you want to mark the speed using different LINKTYPEs.
Yes, I think this is fine.
> I'm happy to allocate the new LINKTYPEs you want, as long as you
> understand the limitations.
The pcap format limitations are fine with me.
> I would personally make the speed an attribute of a
> speed-independant linktype.
That would require defining pseudoheader that would have to be included
in every packet. And it would only solve the corner case that the
currently available open-source friendly sniffers do not presently
handle.
I think it is fine to assume that any tool that would create full-speed
captures that contain both full-speed and low-speed data should be able
to write pcapng file (or simply create two separate pcap files).
--- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
