OpenCALEA
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Historical
Re: [OpenCALEA] Recent updates
- From: Jesse Norell
- Date: Tue May 15 18:54:58 2007
Just a note, as I'm reading up on PCAP .. looks like pcap format has
both a LINKTYPE_NULL (and maybe LINKTYPE_RAW) that we could use to save
our raw packets, though that does mean we'd have to reformat them as we
save, which right now we've avoided. We could make "raw" be streamed in
pcap format, too, but without link layer headers (LINKTYPE_NULL) and
avoid that. We'll have to give some thought to how we receive multiple
simultaneous streams for the same CaseID (try to mux them in
df_collector, or just save to different files or ??).
On Tue, 2007-05-15 at 15:59 -0600, Jesse Norell wrote:
> I'm unsure what -p raw will
> be, or maybe we'll just abandon it and only have pcap format. "raw"
> makes sense for streaming, but not really for saving to disk.
--
Jesse Norell - jesse@kci.net
Kentec Communications, Inc.
|
