----- Original Message -----
From: "Guy Harris" <gharris@xxxxxxxxx>
To: "Ethereal development" <ethereal-dev@xxxxxxxxxxxx>
Sent: Tuesday, February 28, 2006 11:44 PM
Subject: Re: [Ethereal-dev] Preparing for 1.0
Gianluca Varenni wrote:
Wiretap saves the offset of each packet into memory to support random
access to the file. The offsets should be 64 bits, and together with the
offsets you need to save the byte order of that block, or alternatively
the ID of the section containing the packet (a file can contain multiple
sections, each one with a different byte order, different interface
descriptions, bla bla bla).
What will the API offered by NTAR be to allow random access? Will it
maintain the byte order table (so that it will look up the offset and
determine what byte order to use), or will the caller of NTAR be expected
to supply that?
I don't know exactly (I still need to work on that). There are pro's and
con's for NTAR mantaining an internal byte order table:
+ it's much easier for the caller, since he just need to store an offset
inside the trace file (ok, supposing that NTAR returns an offset, and not
some opaque handle).
- NTAR needs to build this table, and this can be tricky (and time
consuming) in case of traces containing multiple sections without an
explicit length (i.e. SHB::Section Length = 0xffffffffffffffff).
+/- other things that does not come to my mind now...
Since it's not clear (to me) if
a. NTAR will be used inside Ethereal and
b. independently from that, if there are other important requirements that
should be added in Wiretap to support pcap-NG, or any other file format
(after some thought, I realize that the byte order is not a *strict*
requirement, supposing to use byte order tables)
I think the only needed modification is the support for 64bit file offsets
(which is maybe already available in wiretap).
Probably the list of interfaces and/or sections in a file will be saved
in some specific pcap-NG structure used by wiretap, so no direct
modification should be done in wiretap for this (not 100% sure, correct
me if I'm wrong).
Wiretap will need to provide an API that supplies interface information to
its caller; as it supports non-libpcap and non-pcap-NG files, it would
probably need to supply that in a form abstracted enough to handle other
file types.
I'm not 100% sure of what you were trying to say, and probably I would need
to have a closer look at the wiretap interface to comment on this...
Have a nice day
GV
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev
