Wireshark · Ethereal-dev: Re: [Ethereal-dev] WTAP_ENCAP_PER_PACKET for PCAP files?

[Guy Harris <guy@xxxxxxxxxxxx>]

On Wed, Oct 29, 2003 at 11:38:24AM +1300, Jesper Peterson wrote:
> Are libpcap TNG plans online somewhere?

No - there aren't any plans yet, just ideas such as

	1) Michael Richardson suggested that it be possible to
	   concatenate files with "cat" (i.e., it should be OK to have a
	   file header in the middle of a bunch of packets);

	2) I'd like to have it be able to handle a multi-interface
	   capture, giving interface names (if available) and link-layer
	   types (i.e., different interfaces could have different
	   link-layer types);

	3) I'd like the per-packet header to include information such as
	   the length of the packet's CRC field, if any (to handle both
	   PPP, where it can change during a session with negotiation,
	   and various LANs where sometimes you get a CRC from the
	   driver and sometimes you don't), a direction flag
	   (incoming/outgoing/promiscuous, at minimum, and maybe
	   including incoming unicast/incoming multicast/incoming
	   broadcast, but also including "unknown") and possibly
	   link-layer-dependent flags such as "bad CRC", "runt frame",
	   "frame too long", etc.;

	4) I'd like the format to be extensible, with both per-file
	   attributes and per-packet attributes, in TLV form, so that
	   new capabilities can be added without breaking existing
	   software that reads the file;

and maybe some other items I've forgotten about.