[pcap-ng-format] Proposal for new "custom" option codes

[Jasper Bongertz]

Wednesday, July 22, 2015, 8:27:40 PM, Guy Harris wrote:

>> I think we need a way for blocks/options:
>> 1) To survive file "re-writing" - i.e., being merged, filter-based
>> exported, etc.

> That's why I added those plugin mechanisms to libwireshark.  There
> still need to be more plugins, to handle merging, as merging may
> require changes to the contents (for example, re-assigning interface
> IDs and mapping interface IDs in input packets from the input files
> to interface IDs in the output file).

Yeah, that's where the headache starts, because you need to find out
which interfaces you have in the input file and which ones of those
you really need in the output file. A file should not contain IDBs
that are not referenced by at least one output packet.

Also, you may want to merge identical IDBs in multiple input files
into a single IDB in the output file, which is easy for Windows
captures because interface names are based on GUIDs and a game of
chance for all other captures.

Cheers,
Jasper
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3681 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://www.winpcap.org/pipermail/pcap-ng-format/attachments/20150722/c5e4cd3b/attachment-0001.bin>