Wireshark-bugs: [Wireshark-bugs] [Bug 6718] Wiretap API needs to handle pcap-NG ISB blocks
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6718
--- Comment #27 from Anders Broman <anders.broman@xxxxxxxxxxxx> 2012-03-12 09:12:53 PDT ---
Hi,
I'm not sure how ISB:s should be handled
"An Interface Statistics Block is normally placed at the end of the file, but
no assumptions can be taken about its position - it can even appear multiple
times for the same interface."
We could read the ISB(s) into wtapng_if_descr_t
:
/* XXX: guint64 if_tsoffset; opt 14 A 64 bits integer value that
specifies an offset (in seconds)...*/
guint8 num_stat_entries;
GArray *interface_statistics; /**< An array holding
the interface statistics from pcapng ISB:s or equivalent(?)*/
} wtapng_if_descr_t;
and writing them we would have to put them at the end of the file as it would
be difficult to put them back at the "same" relative position as they were
found at. Possibly they could be treated as packets with their own link type
and "live" in the packet list which would make it possible to put them
back as found, I'm not sure of the usefullness of that.
Should the first option be favored?
Anders
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
