Proposed solution¶

• Optionally use pcapng format instead of pcap (compile-time, run-time?)
  • Extended Packet Block option field supports arbitrary option code (can get one assigned or use 1 in MSB to signify local) with TLV format for block
  • Use this to store flowid in every packet for a given flow
  • Will allow strong correlation of FULL session that triggered alert
  • Can reduce duplication of packet data for flows that trigger multiple alerts
• libpcap only supports reading pcapng (not all fields)
• NTAR (http://www.winpcap.org/ntar/) is a library that could be used to provide writing in the short-term
• Can also write flowid in files metadata for file extraction to allow easy linkage back to flows (array to prevent duplicates)