[pcap-ng-format] What happens if an interface's attributes,	as given in IDB options, change over the course of a capture?
    Guy Harris 
    guy at alum.mit.edu
       
    Sat Jul 14 16:14:09 PDT 2012
    
    
  
I.e., what happens if, for example, you're capturing on an interface with a leased DHCP-assigned address and, when it tries to renew the lease, it gets a different address?  (Probably not a nice thing for the DHCP server to do, as it might, for example, disrupt existing TCP connections, but....)
Or if you start a capture, clamshell your laptop, take it elsewhere, and then open up the laptop on a different network, and the Wi-Fi interface gets a different IP address?
Some way of indicating a change to some of the IDB options for an interface (complete with time stamp?) might be useful.
    
    
More information about the pcap-ng-format
mailing list