Thanks Guy. That's fine by me. I was just looking for clarificatiion.
Best regards...Paul
Sent from Samsung Mobile on O2
-------- Original message --------
From: Guy Harris
Date:11/06/2016 01:18 (GMT+00:00)
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] PCAP-NG Block Formats
On Jun 10, 2016, at 4:09 PM, Guy Harris <[email protected]> wrote:
> The spec should discuss that more, including emphasizing that a reader must
> pay attention to the block total length when processing options - or deciding
> whether there are any options to process. I'll look at doing that.
OK, the spec now says
All the block bodies MAY embed optional fields. Optional fields can be
used to insert some information that may be useful when reading data, but that
is not really needed for packet processing. Therefore, each tool can either
read the content of the optional fields (if any), or skip some of them or even
all at once.
Skipping all the optional fields at once is straightforward because
most of the blocks are made of a first part with fixed format, and a second
optional part. Therefore, the Block Length field (present in the General Block
Structure, see Section 3.1) can be used to determine how many bytes of optional
fields, if any, are present in the block. That value can be used to determine
whether the block has optional fields (if it is zero, there are no optional
fields), to check, when processing optional fields, whether any optional fields
remain, and to skip all the optional fields.
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <[email protected]>
Archives: https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:[email protected]?subject=unsubscribe
______________________________________________________________________
This message contains confidential information and is intended only for the
individual named. If you are not the named addressee you should not
disseminate, distribute or copy this e-mail. Please notify the sender
immediately by e-mail if you have received this e-mail by mistake and delete
this e-mail from your system.
Any views or opinions expressed are solely those of the author and do not
necessarily represent those of Advance Seven Ltd. E-mail transmission cannot be
guaranteed to be secure or error-free as information could be intercepted,
corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The
sender therefore does not accept liability for any errors or omissions in the
contents of this message, which arise as a result of e-mail transmission.
Advance Seven Ltd. Registered in England & Wales numbered 2373877 at Endeavour
House, Coopers End Lane, Stansted, Essex CM24 1SJ
______________________________________________________________________
This email has been scanned by the Symantec Email Security.cloud service.
For more information please visit http://www.symanteccloud.com
_________________________________________________________________________________________________________________________________________________
Sent via: Wireshark-dev mailing list <[email protected]>
Archives: https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:[email protected]?subject=unsubscribe
