Massimo Sala wrote:
About pcap_major_version() and pcap_minor_version():
- if they return the version of an existent dump file, I agree they need a previous call to pcap_open_offline() or pcap_open() to open the file and read its header
- if they return the current version of the file header, used by the library to create a new file, this information is inside the library, no need an open pcap_t handle
What do you think about this two different behaviours ?
I think they are, as you note, two different behaviors, and that pcap_major_version() and pcap_minor_version() were intended by the people who originally created libpcap to implement the first behavior (as is obvious from the code that implements them, which *does* implement the first behavior). They do not implement the second behavior.
And, more complex, if I call pcap_open_offline(), then I want to get the *current library* file header version ?
That's the second behavior.
I think it is better not to overload the same function, but create two distinct APIs:
pcap_file_version_library(void)
pcap_file_version_file(pcap_t session_handle)
Given that the two behaviors (give me the file version numbers for the file I opened for reading, and give me the file version numbers I'd get if I opened a file for writing) are different, I agree that they shouldn't - and *can't* - be implemented with the same functions.
Fortunately, they aren't implemented with the same functions, because only one of them is implemented.
The first of those behaviors are already implemented with pcap_major_version() and pcap_minor_version(). Arguably, they should have better names, but, as they already exist, the names aren't going to change. I'm not sure the names are a compelling reason to add new functions.
The second of those behaviors isn't implemented by any functions.
Note that, in the future, libpcap might write more than one file format - when a version comes out that implements the new libpcap format, I'm not sure whether we'll only support writing the new format, or will also support writing the old format, for the use of programs that need to be able to write files that can be read by other programs that only read the old format. In that case, I'm not sure what functions that return the major and minor version number that would be used when writing a file would return - the version numbers of the new format, or the version numbers of the old format?
For what purpose do you need the version of the file that would be written?
================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[email protected]/
To unsubscribe use mailto: [EMAIL PROTECTED]
==================================================================
