[ntar-workers] Re: Major rework / review of pcapng file formatin CVS - please review

[Guy Harris]

On Oct 22, 2007, at 2:44 PM, Gianluca Varenni wrote:

> My bad, I was not clear at all here. My point is that we should  
> probably have a way in the fcslen option of the Interface  
> Description Block to say that the fcslen is per-packet, and it's  
> saved as a per-packet option (e.g. if_fcslen=0xFFFFFFF). Otherwise  
> the problem is that the if_fcslen (in the IDB) specifies a "default"  
> FCS, but then you would need to scan the per-packet options to know  
> if the effective FCS len for that packet is the "default" one or a  
> specific per-packet one. What I want is a way to say "ok, the FCS  
> len is fixed, 4 bytes. You will not find a per-packet FCSLEN in the  
> packet options." or "the FCS is per-packet. You need to read the per- 
> packet options to know the effective FCS len. If you don't find it,  
> then the FCS len is the one stored in the IDB".

What if there is no if_fcslen option?  Does that mean "no FCS" or  
"check the per-packet options to see what the FCS length is"?

If so, then having an if_fcslen option could mean "ignore the FCS  
length in the per-packet options", although some applications will be  
looking at the flags anyway; we should probably say that the behavior  
of a program reading a pcap-NG file is undefined if a packet has a per- 
packet FCS length that's not equal to the if_fcslen option's value, so  
that an application can either ignore the epb_flags option, process it  
fully, or process the FCS in it only if there's no if_fcslen option.