[ntar-workers] NTAR 1.1.0.190 is available on the website.

[Gianluca Varenni]

----- Original Message ----- 
From: "Guy Harris" <guy at alum.mit.edu>
To: <ntar-workers at winpcap.org>
Sent: Tuesday, July 12, 2005 11:31 AM
Subject: Re: [ntar-workers] NTAR 1.1.0.190 is available on the website.


>
> On Jul 9, 2005, at 7:41 PM, Gianluca Varenni wrote:
>
>> I've just finished uploading a new version of NTAR on the website.
>
> I see an error code NTAR_FAILURE_INVALID_ID, for which the comment is 
> "The identifier of a block or an option is not valid or unknown."
>
> Presumably this is never returned for "unknown" when reading - NTAR 
> should simply ignore unknown blocks or options when reading so that  it 
> can read files written by newer versions of NTAR (or perhaps  somehow 
> supply them as opaque data, so an application that reads and  processes a 
> pcap-NG file and writes the results to another pcap-NG  file can just 
> blindly copy unknown blocks and options).

No. This error is returned when you ask NTAR to decode a block whose ID is 
unknown to the library.

Basically, what you do is:

//this will give you an opaque handle to the block, ntar only reads the 
block header
//this call will not fail with INVALID_ID
ntar_get_next_block(..., &block_handle);

//this asks NTAR to actually decode the block data (through the plugins) and 
return such decoded info
// this can fail if NTAR does not know the block ID
ntar_get_block_data(block_handle, &block_data);

Have a nice day
GV






>
> _______________________________________________
> ntar-workers mailing list
> ntar-workers at winpcap.org
> https://www.winpcap.org/mailman/listinfo/ntar-workers