From aeb827b3615d3ecea857c355ed6c4211833450c6 Mon Sep 17 00:00:00 2001 From: Eric Harding Date: Fri, 28 Aug 2026 10:33:46 -0400 Subject: [PATCH] Retire pcapstream references, note the preallocation trap is scpcap-scoped MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit pcapstream-server is abandoned in favor of scpcap; drop the stale reference in the doc's status line. Add a footnote to ยง7.2 clarifying that the preallocating-writer hazard we just spent significant effort diagnosing and fixing in scpcap's raw-.pcap tailer doesn't apply to this document's .pcap.zst format: the compressed writer only ever appends, and nothing that preallocates writes .pcap.zst directly, so fstat-based phys/src tracking here remains sound as-is. --- STREAMING_ZSTD_FORMAT.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/STREAMING_ZSTD_FORMAT.md b/STREAMING_ZSTD_FORMAT.md index e02938b..96a54cf 100644 --- a/STREAMING_ZSTD_FORMAT.md +++ b/STREAMING_ZSTD_FORMAT.md @@ -1,6 +1,6 @@ # Streaming `.pcap.zst` Format -**Status:** implemented (Rust reference: `pcapstream-core`, `pcapstream-server`, `pcapstream-client`) +**Status:** implemented (Rust reference: `scpcap`) **Audience:** an implementer writing a C++ reader that streams pcap records out of a `.pcap.zst` file *while it is still being written*. @@ -305,6 +305,12 @@ Only then do you know the final size, which for a `.pcap.zst` is the **source fr (`src_pos`), *not* the physical file size. (For a raw `.pcap` the two coincide, which is a trap if you generalize from the raw path.) +*(This is strictly a hazard for a raw `.pcap` reader, not for this format: a writer that +preallocates space ahead of its real cursor can make even `fstat`'s reported size diverge from +real content, which requires content-level record validation to detect โ€” not just the phys/src +split above. The `.pcap.zst` writer here never preallocates, and nothing that preallocates writes +`.pcap.zst` directly, so this doesn't apply to the format described in this document.)* + If (1) holds but (2) doesn't โ€” the rename landed but there's still an unframed tail โ€” **wait**. Do not declare completion with a size you'd have to revise. Poll again; the tail is already fully written, so this resolves on the next tick.