On Wed, Nov 28, 2018 at 9:53 AM Jim Hague <j...@sinodun.com> wrote: > On 28/11/2018 14:45, Alexey Melnikov wrote: > > On Wed, Nov 28, 2018, at 1:38 PM, Sara Dickinson wrote: > > >> Paul is correct in that the _intention_ of including these fields is > >> just to provide informational meta data about the capturing process. I > >> would suggest we change the first sentence of the section to be: > >> > >> “Parameters providing information to how data in the file was > >> collected (applicable for some, but not all collection environments). > >> The values are informational only and serve as hints to downstream > >> analysers as to the configuration of a collecting implementation. They > >> can provide context when interpreting what data is present/absent from > >> the capture but cannot necessarily be validated against the data > >> captured.” > > I can live with that, but I would like you to in particular add a note > > that pcap filter value should not be trusted, as it effectively can > > contain arbitrary text string. > > OK, thanks. We will do that. >
Excellent! Please let me know (LOUDLY) once you've had a chance to do so (and the other comments too). > >> Given that, I’m hoping the short reference is > >> acceptable http://www.tcpdump.org/manpages/pcap-filter.7.html? > > Yes. > > WFM! W > Thanks. > -- > Jim Hague - j...@sinodun.com Never trust a computer you can't > lift. > > -- I don't think the execution is relevant when it was obviously a bad idea in the first place. This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants. ---maf
_______________________________________________ DNSOP mailing list DNSOP@ietf.org https://www.ietf.org/mailman/listinfo/dnsop
