Re: [DNSOP] [Ext] Alexey Melnikov's Discuss on draft-ietf-dnsop-dns-capture-format-08: (with DISCUSS and COMMENT)

[Jim Hague <[e-mail]>]

On 28/11/2018 14:45, Alexey Melnikov wrote:
> On Wed, Nov 28, 2018, at 1:38 PM, Sara Dickinson wrote:

>> Paul is correct in that the _intention_ of including these fields is
>> just to provide informational meta data about the capturing process. I
>> would suggest we change the first sentence of the section to be:
>>
>> “Parameters providing information to how data in the file was
>> collected (applicable for some, but not all collection environments).
>> The values are informational only and serve as hints to downstream
>> analysers as to the configuration of a collecting implementation. They
>> can provide context when interpreting what data is present/absent from
>> the capture but cannot necessarily be validated against the data
>> captured.”
> I can live with that, but I would like you to in particular add a note
> that pcap filter value should not be trusted, as it effectively can
> contain arbitrary text string.

OK, thanks. We will do that.

>> Given that, I’m hoping the short reference is
>> acceptable http://www.tcpdump.org/manpages/pcap-filter.7.html? 
> Yes.

Thanks.
-- 
Jim Hague - [e-mail]          Never trust a computer you can't lift.