[ntar-workers] On Markers and Bookmarks

[Christian Kreibich]

On Mon, 2005-07-11 at 22:43 -0700, Gianluca Varenni wrote:
>
> The only real issue I see in in-situ restoration is alignment. The spec 
> clearly states that every block should be aligned to 32bit boundaries. We 
> can have ntar (or any other implementation of pcap-ng) ignore this detail, 
> create non-aligned "garbage" blocks to fix the truncated captures, and tweak 
> the code to deal with "garbage" blocks differently (by spec, the block 
> header contains the "useful" block length, that can be unaligned to 32 bits, 
> but the actual block size is ALIGN_TO_32BITS(block_unaligned_size)), but in 
> any case you have a file that cannot be made well-formed.

Does anyone have observations on what typically causes truncated files,
and whether the resulting sizes are truly random (as opposed to
multiples of some granularity)?

I was just thinking that maybe we could be lucky in the sense that if
truncation does typically happen on the "boundaries" of buffered output
then truncated files could be alignable on 32 bit more often (since
buffered output certainly happens on multiples of 32bit).

Note I'm not saying that this is in any way to be relied upon etc, just
that we might be lucky a bit more often than it seems?

Of course this could all be total nonsense :)

Cheers,
Christian.
-- 
________________________________________________________________________
                                          http://www.cl.cam.ac.uk/~cpk25
                                                    http://www.whoop.org