Stephen Donnelly

So 20 bytes of SHA1 becomes 28 bytes in Base64, saving 12 bytes compared to hexadecimal at 40 bytes, although with quotes you get to 30. How long would it...

This sounds like a good idea. Some questions: The ticket title specifies _pcapng files_, but you also intend live capture to support the pcapng format, blocks etc? The API for...

> > Should libpcap create a SHB when starting live capture, and emit it as the first block > > Yes. With Section Length set to -1 presumably. In support...

> Yes, given that it doesn't know how bit the section will be - and, given that it might be writing to a pipe, it might not even be able...

Right, navigable meaning an index of Sections like book chapters in the UI. With Section Lengths present this could typically be generated in less than a second. Seeking meaning selecting...

> But section boundaries are arbitrary; there's no guarantee that, for example, a request won't be in one section and the reply to it in another. Do they really correspond...

> > I think that multiple Sections per capture or file can be useful, and would be worth supporting in libpcap. The capturing application can do most of the work....

> ...and, of course, only do that if the total number of bytes worth of blocks written to the section, after the SHB was written, is < 07FFFFFFF; otherwise, it...

> Also, we may, in the future, support modules for the lower-level IO part of reading and writing capture files, to allow asynchronous I/O, direct reading and writing of compressed...

> I.e., having an API to switch sections is simpler? Yes, provided the Section can be switched after a block has been received for the new section. I.e. dumpcap wants...