Hacker News Reader

Is there some reason/significance for collecting all the protocol captures into a single file? I would have thought that a tarball containing separate captures one per protocol would be more useful wouldn't it?

View on HN

As a network guy this was my first thought as well. Putting everything and the kitchen sink in a single file just serves to obfuscate the relations, interactions, and dependencies of many protocols. For instance good luck opening this up to get an understanding that certain multicast protocols require certain information in IGMPv3 fields to come up the way it shows in the pcap.

Simply filtering for the high level protocol tells you A LOT less than having a barebones capture which shows all of the things that happen for that high level protocol to work and nothing more.

Not really. It's kind of like going to Project Gutenberg and zipping together the first chapter of every work. And then advertising it as "This is a sampling of literature!"

I mean it is, but most people wouldn't read literature that way.

Reply on news.ycombinator.com