[pcap-ng-format] Does PCAPNG have just one version number?

[Guy Harris]

On Apr 1, 2013, at 6:30 AM, Paul Long <Paul.Long at microsoft.com> wrote:

> We want to display an appropriate version for PCAPNG files.  For instance for Netmon .cap, we have various version we could show.  My take is that you can have multiple PCAPNG version headers, so I’m assuming there is no ONE version to display.

A pcap-ng file can be composed of multiple sections (the intent here is to allow files to be concatenated by a tool such as UN*X's cat command), each with its own Section Header Block, so, in theory, there could be multiple versions.

If you haven't read the entire file, showing the version from the first section, and noting that it's just the first section, might be appropriate.  If you have read the entire file, showing a list of versions might be the right thing to do.