Wireshark-dev: Re: [Wireshark-dev] Filebacked-tvbuffs : GSoC'13
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 12 May 2013 23:10:53 -0700
On May 12, 2013, at 10:57 PM, Anders Broman <a.broman@xxxxxxxxxxxx> wrote:

> So either this is a bad idea, don't pursue it or everything we can read we should be able to write in pcap-ng
> as a temporary file at least.

...or if we're going to store the contents of packet *not* just generated by gluing together stuff from the capture file (e.g., stuff generated by decompressing packet data or decrypting packet data), we should store it in a temporary file with a format that we control, rather than a capture file format.  (Yes, that means that the results of that won't be *saved*, but there's no obligation for us to *avoid* regenerating decompressed/decrypted/etc. packet data.)

I.e., having a capture file format that saves *arbitrary higher level packets* so that we can just read those packets is *NOT* a required goal of this project.