[ntar-workers] PCAP-NG / Interface ID size / Drops Counter size ?

[Hannes Gredler]

hi fulvio, et al,

i was digesting the pcap-ng spec and wondered why
the size of interface ID (Packet Block, Interface Statistics Block)
is only 16-Bit ?

while that may seem adequate for hosts, most router
implementations have internal 32-Bit index size.
on some of the larger scale implementations for our clients
we do exceed the 16-Bit Index space today.

another comment wrt to the 16-Bits drops field in the Packet Block.
my feeling is that this is too small-sized as well.

let me give an example for illustration:
  if you capture lets say on a high-peed interface (oc-768)
  and you have a short 1ms disruption then you may not even express
  that 1ms glitch given the max offered load of 100mpps.

  IMO packet-counters (including drop counters)
  always should be expressed as 64-bit entities.


i wondered if the spec could get amended to support
broader fields.

tx,

/hannes

---

refs:

http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html

-> see paragraph 3.3 Packet Block
    Interface-ID
    Drops count

-> see paragraph 3.6 Interface Statistics Block
    Interface-ID