[ntar-workers] PacketBlock, PacketsBlock, GoPBlock

[Christian Kreibich]

On Thu, 2005-07-07 at 09:32 -0700, Gianluca Varenni wrote:
>
> > One reason to support an old-pcap format compatibility mode might be to 
> > support cases where new and old-style captures are accidentally 
> > concatenated.  I'm not saying that it should be done, just that such 
> > mismatched concatenation will happen, and if it doesn't make things 
> > intolerably complicated, it could be useful.
> 
> I know that it will probably happen, but I think that (at least for the 
> moment) we should "ignore" the problem. I think that adding the support in 
> NTAR for detecting/reading mixed mode trace files (i.e. pcap-ng sections 
> mixed with old-pcap traces) adds unneeded complexity (I would say "crap") to 
> the library. What we can "easily" do is add some detection code in ntar that 
> is (usually) able to detect the beginning of an old-pcap trace file (using 
> the old-pcap magic numbers) when a section header block was expected.

Yeah. Do at most that. The format is looking to good to bloat it with
serious backward compatibility. 

Cheers,
Christian.
-- 
________________________________________________________________________
                                          http://www.cl.cam.ac.uk/~cpk25
                                                    http://www.whoop.org