Skip to content

Commit e6bd082

Browse files
saleynsaleyn
committed
Make timestamp optional
This change makes the timestmap optional and also moves it past the Options data. This way if the packet is compressed, the compression would also include the options, as well as the timestamp.
1 parent 5b04803 commit e6bd082

File tree

1 file changed

+121
-64
lines changed

1 file changed

+121
-64
lines changed

‎draft-tuexen-opsawg-pcapng.xml‎

Lines changed: 121 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -1937,90 +1937,171 @@ Section Header
19371937

19381938
<section title="Experimental Blocks (deserve further investigation)">
19391939

1940-
<section anchor="section_apb" title="Alternative Packet Blocks (experimental)">
1940+
<section anchor="section_apb" title="Alternative Packet Block (experimental)">
19411941

19421942
<t>Alternative Packet Block offers an intermediate layout between
1943-
the Simple Packet Block and the Enhanced Packet Block. Just like the
1944-
Enhanced Packet Block it stores a timestamp of each packet, but
1945-
all other fields in the fixed part of the Alternative Packet
1946-
Block's body are made optional and can be stored in the Options
1947-
section. The packet's body of this block MAY be compressed.
1943+
the Simple Packet Block and the Enhanced Packet Block. The
1944+
timestamp of a packet, and other fields that are present in the
1945+
Enhanced Packet Block are made optional in the Alternative Packet
1946+
Block and can be stored in the Options section. The Options,
1947+
Timestmap, and packet's body of this block MAY be compressed.
1948+
This packet block type is intended for use cases that store large
1949+
number of packets, are concerned about storage size, and optionally
1950+
engage compression. This block type has minimal overhead of 16
1951+
octets in storing packet data (size of: 'Block Type',
1952+
2 * 'Block Total Length', 'APB Flags').
19481953
</t>
19491954

19501955
<figure anchor="formatapb" title="Alternative Packet Block Format">
19511956
<artwork xml:space="preserve" name="" type="" align="left" alt="" width="" height="">
19521957
0 1 2 3
19531958
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
19541959
+---------------------------------------------------------------+
1955-
0 | Block Type = 0x00000010 |
1960+
0 | Block Type = 0x0000000A |
19561961
+---------------------------------------------------------------+
19571962
4 | Block Total Length |
19581963
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1959-
8 | Timestamp (High) |
1960-
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1961-
12 | Timestamp (Low) |
1962-
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1963-
16 / /
1964-
/ Options (variable) /
1965-
/ /
1966-
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1967-
/ /
1968-
/ Packet Data /
1969-
/ variable length, padded to 32 bits /
1970-
/ /
1971-
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
1964+
8 | APB Flags (apb_flags, code = 0x2001) |
1965+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ \
1966+
12 / / \
1967+
/ Options (variable) / +
1968+
/ / |
1969+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
1970+
| Optional Timestamp (High) | |
1971+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +- This part MAY
1972+
| Optional Timestamp (Low) | | be compressed
1973+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
1974+
/ / |
1975+
/ Packet Data / |
1976+
/ variable length, padded to 32 bits / +
1977+
/ / /
1978+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ /
19721979
| Block Total Length |
19731980
+---------------------------------------------------------------+
19741981
</artwork>
19751982
</figure>
19761983

1977-
<t>The permissible options listed in the table below are of
1978-
Simple Option type (see <xref target="section_simple_option"/>)
1984+
<t>The Alternative Packet Block has the following fields:
1985+
<list style="symbols">
1986+
<t>Block Type: the block type of the Enhanced
1987+
Packet Block is 0x0A</t>
1988+
1989+
<t>Block Total Length: total size of this block,
1990+
as described in <xref target="section_block"/></t>
1991+
1992+
<t>APB Flags Option: Alternative
1993+
Packet Block Flags - MANDATORY option formatted as Simple Option
1994+
(see <xref target="section_simple_option"/>)
1995+
with code 0x2001. The APB Flags indicate presence of a Timestamp,
1996+
uncompressed Options size, and characteristics of the Packet Data.
1997+
See <xref target="apb_flags"/> for permissible bit settings.
1998+
This option MAY include total byte size of Options. If the size
1999+
is specified, then the opt_endofopt option is OPTIONAL. The value
2000+
of apb_opt_size is the number of octets comprising the entire
2001+
Options section in this block not counting the APB Flags. If
2002+
present, this option MUST be the first one in the Options data.</t>
2003+
2004+
<t>Options: list of permissible option values listed in the table
2005+
below are of Simple Option type (see
2006+
<xref target="section_simple_option"/>). The Options MAY be
2007+
compressed if the Compression Bits of the apb_flags are on.</t>
2008+
2009+
<t>Optional Timestmap (High) and Timestamp (Low): upper 32 bits
2010+
and lower 32 bits of a 64-bit timestamp. If the Timestamp bit of
2011+
the apb_flags is on, then the Timestamp (High/Low) is present
2012+
after the Options. If there is no apb_flags option or the
2013+
Timestamp bit of the apb_flags option is off, then the timestamp
2014+
is not present. If the Compression bits of the apb_flags option
2015+
are on, then the Options, Timestamp, and Packet Data are
2016+
compressed using Compression Type specified in the apb_flags.
2017+
Otherwise it's not compressed.
2018+
The timestamp is a single 64-bit unsigned integer that
2019+
represents the number of units of time that have elapsed since
2020+
1/1/1970 00:00:00 UTC. The length of a unit of time is specified
2021+
by the 'if_tsresol' option (see <xref target="format_idb"/>) of
2022+
the Interface Description block referenced by this packet.
2023+
Note that, unlike timestamps in the libpcap file format,
2024+
timestamps in Enhanced Packet Blocks are not saved as two 32-bit
2025+
values that represent the seconds and microseconds that have
2026+
elapsed since 1/1/1970 00:00:00 UTC. Timestamps in Enhanced
2027+
Packet Blocks are saved as two 32-bit words that represent
2028+
the upper and lower 32 bits of a single 64-bit quantity.</t>
2029+
2030+
</list>
19792031
</t>
19802032

2033+
<texttable title="Alternative Packet Block Flags" anchor="apb_flags">
2034+
<ttcol align="left">Bit Number</ttcol>
2035+
<ttcol align="left">Description</ttcol>
2036+
2037+
<c>0</c>
2038+
<c>Timestamp bit (0 = no timestamp, 1 = has timestmap)</c>
2039+
2040+
<c>1-2</c>
2041+
<c>Packet Direction. (00 = information not
2042+
available, 01 = inbound packet, 10 = outbound packet)</c>
2043+
2044+
<c>3-5</c>
2045+
<c>Reception Type (000 = not specified, 001 = unicast,
2046+
010 = multicast, 011 = broadcast, 100 = promiscuous).</c>
2047+
2048+
<c>6-11</c>
2049+
<c>Compression Type. When specified, the optional Timestamp and
2050+
Packet Data contents are compressed. Permissible types:
2051+
0 (uncompressed), 1 (lzw), 2 (gzip), 3 (bzip2), 4 (zip),
2052+
5 (7z), 6 (lzo), 7 (ucl), 8 (snappy), other???</c>
2053+
2054+
<c>12-15</c>
2055+
<c>Reserved</c>
2056+
2057+
<c>16-23</c>
2058+
<c>Total uncompressed byte size of Options in this section
2059+
excluding the APB Flags. This setting is OPTIONAL. If set to 0,
2060+
then opt_endofopt is REQUIRED.</c>
2061+
</texttable>
2062+
2063+
<t>Options are described in the table below:</t>
2064+
19812065
<texttable anchor="options_apb" title="Alternative Packet Block Options">
19822066
<ttcol align="left">Name</ttcol>
19832067
<ttcol align="left">Code</ttcol>
19842068
<ttcol align="left">Length</ttcol>
19852069
<ttcol align="left">Multiple allowed?</ttcol>
19862070

1987-
<c>apb_opt_size</c>
1988-
<c>0x2001</c>
1989-
<c>-</c>
1990-
<c>no</c>
1991-
19922071
<c>apb_orig_len</c>
19932072
<c>0x2002</c>
19942073
<c>-</c>
19952074
<c>no</c>
19962075

1997-
<c>apb_iface_id</c>
2076+
<c>apb_capt_len</c>
19982077
<c>0x2003</c>
19992078
<c>-</c>
20002079
<c>no</c>
20012080

2002-
<c>apb_flags</c>
2081+
<c>apb_iface_id</c>
20032082
<c>0x2004</c>
20042083
<c>-</c>
20052084
<c>no</c>
2085+
20062086
</texttable>
20072087

20082088
<t>
20092089
<list hangIndent="8" style="hanging">
2010-
<t hangText="apb_opt_size:"><vspace blankLines="0"/>
2011-
Total byte size of options. If this option is specified, then
2012-
the opt_endofopt option is OPTIONAL. The value of apb_opt_size
2013-
is the number of octets comprising the entire Options section in
2014-
this block. If present, this option MUST be the first one in the
2015-
Options data.</t>
2016-
2017-
<t hangText="apb_orig_len:"><vspace blankLines="0"/>Packet's
2018-
Original Length. Actual length of the packet when it was
2090+
<t hangText="apb_orig_len:"><vspace blankLines="0"/>Original
2091+
Packet Length. Actual length of the packet when it was
20192092
transmitted on the network. It can be different from captured
2020-
packet length, which is the min(snapshot length, bytes left in
2021-
the block), if the packet has been truncated by the capture
2093+
packet length if the packet has been truncated by the capture
20222094
process.</t>
20232095

2096+
<t hangText="apb_capt_len:"><vspace blankLines="0"/>Captured
2097+
Packet Length: number of octets captured from the packet (i.e.
2098+
the length of the uncompressed Packet Data field). It will be
2099+
the minimum value among the Original Packet Length and the
2100+
snapshot length for the interface (SnapLen, defined in
2101+
<xref target="format_idb"/>). The value of this field does not
2102+
include the padding octets added at the end of the Packet Data
2103+
field to align the Packet Data field to a 32-bit boundary.</t>
2104+
20242105
<t hangText="apb_iface_id:"><vspace blankLines="0"/>It
20252106
specifies the interface this packet comes from; the correct
20262107
interface will be the one whose Interface Description Block
@@ -2030,33 +2111,9 @@ Section Header
20302111
matching interface description block MUST exist. If this option
20312112
is not defined, interface ID defaults to 0.</t>
20322113

2033-
<t hangText="apb_flags:"><vspace blankLines="0"/>Alternative
2034-
Packet Block Flags indicate characteristics of the Packet Data.
2035-
See <xref target="apb_flags"/> for permissible bit settings.</t>
20362114
</list>
20372115
</t>
20382116

2039-
<texttable title="Alternative Packet Block Flags" anchor="apb_flags">
2040-
<ttcol align="left">Bit Number</ttcol>
2041-
<ttcol align="left">Description</ttcol>
2042-
2043-
<c>0-1</c>
2044-
<c>Inbound / Outbound packet (00 = information not
2045-
available, 01 = inbound, 10 = outbound)</c>
2046-
2047-
<c>2-4</c>
2048-
<c>Reception type (000 = not specified, 001 = unicast,
2049-
010 = multicast, 011 = broadcast, 100 = promiscuous).</c>
2050-
2051-
<c>5-12</c>
2052-
<c>Compression type. When specified, the Packet Data
2053-
content is compressed. Permissible types:
2054-
0 (uncompressed), 1 (lzw), 2 (gzip), 3 (bzip2), 4 (zip),
2055-
5 (7z), 6 (lzo), 7 (ucl), 8 (snappy), other???</c>
2056-
2057-
<c>13-23</c>
2058-
<c>Reserved</c>
2059-
</texttable>
20602117
</section>
20612118

20622119
<section title="Compression Block (experimental)">

0 commit comments

Comments
 (0)