Reading again the PCAP Next Generation Dump File Format specification, i see a defect in the Interface Description Block paragraph: the figure shows no Interface ID inside the block though this field is described underneath.
This was never fixed? Too bad, it would really have been nicer than numerating the interfaces by their order in the list of Interfae Description Blocks.
Or am i missing something?
asked 20 Sep '13, 01:11
You're right, it is not in the block, but it doesn't have to be. When reading a PCAPng file the first Interface Description Block is interface 0, the second is interface 1, and so on. It is sort of mentioned in the sentence that says
To add an index to the block is not necessary, but of course this means that when reading and writing PCAPng files you must keep the interfaces in the same order, or, if reordering them, renumber the interface IDs in all frames headers accordingly.
But since I'm going to work on the specifications in the next couple of weeks/months anyway I'll write down a reminder to myself to clarify this in the text.
answered 20 Sep '13, 01:34
edited 20 Sep '13, 01:35