On 28/11/2018 14:45, Alexey Melnikov wrote: > On Wed, Nov 28, 2018, at 1:38 PM, Sara Dickinson wrote:
>> Paul is correct in that the _intention_ of including these fields is >> just to provide informational meta data about the capturing process. I >> would suggest we change the first sentence of the section to be: >> >> “Parameters providing information to how data in the file was >> collected (applicable for some, but not all collection environments). >> The values are informational only and serve as hints to downstream >> analysers as to the configuration of a collecting implementation. They >> can provide context when interpreting what data is present/absent from >> the capture but cannot necessarily be validated against the data >> captured.” > I can live with that, but I would like you to in particular add a note > that pcap filter value should not be trusted, as it effectively can > contain arbitrary text string. OK, thanks. We will do that. >> Given that, I’m hoping the short reference is >> acceptable http://www.tcpdump.org/manpages/pcap-filter.7.html? > Yes. Thanks. -- Jim Hague - j...@sinodun.com Never trust a computer you can't lift. _______________________________________________ DNSOP mailing list DNSOP@ietf.org https://www.ietf.org/mailman/listinfo/dnsop
