Changes between Version 7 and Version 8 of SupportedTraceFormats


Ignore:
Timestamp:
09/05/07 13:00:24 (14 years ago)
Author:
perry
Comment:

Document limitations and benefits of all the various format types

Legend:

Unmodified
Added
Removed
Modified
  • SupportedTraceFormats

    v7 v8  
    2424 * pcap interfaces
    2525 * Native Linux PF_PACKET interfaces
    26 
    27 By default, pcap trace files written by libtrace are compressed which cannot be handled directly by programs such as tcpdump. Use {{{tcpdump -r <(zcat mytrace.pcap.gz)}}} to read these files.
    28 
    29 Note that libtrace does not include support for writing packets to a network via the RT protocol. Documentation of the RT protocol can be found [wiki:RTProtocol here] which
    30 should enable programmers to write their own RT server.
    31 
    32 Also, currently there is no support for writing to native BSD BPF interfaces but this may be added in a future version of libtrace.
    3326
    3427== Format URIs ==
     
    7366 * Doesn't support uploading bpf filters to the kernel (yet)
    7467 * Supports only incoming and outgoing direction, attempts to set other directions will fail. (3.0.3+)
     68
     69=== Internal PCAP tracefile output (pcapfile:) ===
     70 * Currently always writes out data compressed, even if compression level 0 is used.  This confuses tcpdump which doesn't support compressed traces.  You can use "zcat foo.pcap.gz | tcpdump -r-" to read these traces.
     71
     72=== RT protocol ===
     73 * libtrace does not (yet?) support RT output.
     74 * The [wiki:RTProtocol protocol specification] is available so people can write their own servers.
     75
     76=== BSD BPF Interface ===
     77 * Currently supports capture, but not writing.