[tcpdump-workers] New RFCs for 1) pcap file format and 2) rpcapd protocol?

Guy Harris gharris at sonic.net
Thu Mar 26 22:20:58 EDT 2020


On Mar 26, 2020, at 7:10 PM, Guy Harris via tcpdump-workers <tcpdump-workers at lists.tcpdump.org> wrote:

> (Note that its purpose is to document the *existing* format, rather than be a source of proposed changes.)

...proposed changes to the format.

I am, however, planning on proposing a mechanism for vendor-specific "custom" link-layer types, inspired by the pcapng "custom" block types and option types, for use in both pcap and pcapng.  That'll be in a separate message.

As with pcapng block types and options, anything of *general* use that a vendor would like multiple programs to be able to handle should probably be proposed as a part of the standard, with a register link-layer type/block number/option number.


More information about the tcpdump-workers mailing list