Skip to content

Commit e5d5c23

Browse files
saleynsaleyn
committed
Add Alternative Packet Block
This modification is based on the proposal submitted to the pcap-ng-formati mailing list. It introduces two new features: - Alternative Packet Block - Simple Option Type
1 parent 547a1d4 commit e5d5c23

File tree

1 file changed

+152
-3
lines changed

1 file changed

+152
-3
lines changed

‎draft-tuexen-opsawg-pcapng.xml‎

Lines changed: 152 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -632,6 +632,40 @@ Section Header
632632

633633
</section>
634634

635+
<section anchor="section_simple_option" title="Simple Options">
636+
637+
<t>Simple Options are used for represending integer values that fit
638+
into 24 bits of space.
639+
640+
<figure anchor="formatsimpleopt" title="Simple Options Format">
641+
<artwork xml:space="preserve" name="" type="" align="center" alt="" width="" height="">
642+
0 1 2 3
643+
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
644+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
645+
| Option Code | Option Value |
646+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
647+
</artwork>
648+
</figure>
649+
</t>
650+
<t>A Simple Option has the following fields:
651+
<list style="symbols">
652+
653+
<t>Simple Option Code: The code number for the Simple Option, which
654+
has the upper three bits set to '001'. Given the total size of the
655+
option code equal to 8 bits, there are at most 32 distinct simple
656+
option codes available for each block type.
657+
</t>
658+
659+
<t>Option Value: An integer value stored in 24bits.</t>
660+
</list>
661+
662+
</t>
663+
664+
<t>See <xref target="section_apb"/> for examples of Simple Options
665+
usage.</t>
666+
667+
</section>
668+
635669
</section>
636670

637671
<section title="Data format">
@@ -1903,11 +1937,126 @@ Section Header
19031937

19041938
<section title="Experimental Blocks (deserve further investigation)">
19051939

1906-
<section title="Alternative Packet Blocks (experimental)">
1940+
<section anchor="section_apb" title="Alternative Packet Blocks (experimental)">
1941+
1942+
<t>Alternative Packet Block offers an intermediate layout between
1943+
the Simple Packet Block and the Enhanced Packet Block. Just like the
1944+
Enhanced Packet Block it stores a timestamp of each packet, but
1945+
all other fields in the fixed part of the Alternative Packet
1946+
Block's body are made optional and can be stored in the Options
1947+
section. The packet's body of this block MAY be compressed.
1948+
</t>
1949+
1950+
<figure anchor="formatapb" title="Alternative Packet Block Format">
1951+
<artwork xml:space="preserve" name="" type="" align="left" alt="" width="" height="">
1952+
0 1 2 3
1953+
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
1954+
+---------------------------------------------------------------+
1955+
0 | Block Type = 0x00000010 |
1956+
+---------------------------------------------------------------+
1957+
4 | Block Total Length |
1958+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1959+
8 | Timestamp (High) |
1960+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1961+
12 | Timestamp (Low) |
1962+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1963+
16 / /
1964+
/ Options (variable) /
1965+
/ /
1966+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1967+
/ /
1968+
/ Packet Data /
1969+
/ variable length, padded to 32 bits /
1970+
/ /
1971+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1972+
| Block Total Length |
1973+
+---------------------------------------------------------------+
1974+
</artwork>
1975+
</figure>
1976+
1977+
<t>The permissible options listed in the table below are of
1978+
Simple Option type (see <xref target="section_simple_option"/>)
1979+
</t>
1980+
1981+
<texttable anchor="options_apb" title="Alternative Packet Block Options">
1982+
<ttcol align="left">Name</ttcol>
1983+
<ttcol align="left">Code</ttcol>
1984+
<ttcol align="left">Length</ttcol>
1985+
<ttcol align="left">Multiple allowed?</ttcol>
1986+
1987+
<c>apb_opt_size</c>
1988+
<c>0x2001</c>
1989+
<c>-</c>
1990+
<c>no</c>
1991+
1992+
<c>apb_orig_len</c>
1993+
<c>0x2002</c>
1994+
<c>-</c>
1995+
<c>no</c>
1996+
1997+
<c>apb_iface_id</c>
1998+
<c>0x2003</c>
1999+
<c>-</c>
2000+
<c>no</c>
2001+
2002+
<c>apb_flags</c>
2003+
<c>0x2004</c>
2004+
<c>-</c>
2005+
<c>no</c>
2006+
</texttable>
2007+
2008+
<t>
2009+
<list hangIndent="8" style="hanging">
2010+
<t hangText="apb_opt_size:"><vspace blankLines="0"/>
2011+
Total byte size of options. If this option is specified, then
2012+
the opt_endofopt option is OPTIONAL. The value of apb_opt_size
2013+
is the number of octets comprising the entire Options section in
2014+
this block. If present, this option MUST be the first one in the
2015+
Options data.</t>
2016+
2017+
<t hangText="apb_orig_len:"><vspace blankLines="0"/>Packet's
2018+
Original Length. Actual length of the packet when it was
2019+
transmitted on the network. It can be different from captured
2020+
packet length, which is the min(snapshot length, bytes left in
2021+
the block), if the packet has been truncated by the capture
2022+
process.</t>
2023+
2024+
<t hangText="apb_iface_id:"><vspace blankLines="0"/>It
2025+
specifies the interface this packet comes from; the correct
2026+
interface will be the one whose Interface Description Block
2027+
(within the current Section of the file) is identified by
2028+
the same value (see <xref target="section_idb"/>) of this
2029+
option. The interface ID MUST be valid, which means that an
2030+
matching interface description block MUST exist. If this option
2031+
is not defined, interface ID defaults to 0.</t>
2032+
2033+
<t hangText="apb_flags:"><vspace blankLines="0"/>Flags that
2034+
indicate characteristics of the Packet Data. See
2035+
<xref target="apb_flags"/> for permissible bit settings.</t>
2036+
</list>
2037+
</t>
19072038

1908-
<t>Can some other packet blocks (besides the ones described in the
1909-
previous paragraphs) be useful?</t>
2039+
<texttable title="Alternative Packet Block Flags" anchor="apb_flags">
2040+
<ttcol align="left">Bit Number</ttcol>
2041+
<ttcol align="left">Description</ttcol>
19102042

2043+
<c>0-1</c>
2044+
<c>Inbound / Outbound packet (00 = information not
2045+
available, 01 = inbound, 10 = outbound)</c>
2046+
2047+
<c>2-4</c>
2048+
<c>Reception type (000 = not specified, 001 = unicast,
2049+
010 = multicast, 011 = broadcast, 100 = promiscuous).</c>
2050+
2051+
<c>5-12</c>
2052+
<c>Compression type. When specified, the Packet Data
2053+
content is compressed. Permissible types:
2054+
0 (uncompressed), 1 (lzw), 2 (gzip), 3 (bzip2), 4 (zip),
2055+
5 (7z), 6 (lzo), 7 (ucl), 8 (snappy), other???</c>
2056+
2057+
<c>13-23</c>
2058+
<c>Reserved</c>
2059+
</texttable>
19112060
</section>
19122061

19132062
<section title="Compression Block (experimental)">

0 commit comments

Comments
 (0)