[pcap-ng-format] Comments for unknown blocks [was Re: opsarea presentation?]

[Anders Broman]

Hi,
For Vendor specific blocks why not use http://www.iana.org/assignments/enterprise-numbers or our own registry or a name string/magic number
Or allow more than one option by assigning different tags.

Something like
       0 -31
0 | Block Type = TBD ( Private block type ID )   
4 | Block total lenghth
8 | Vendor ID Type TAG                                       /* OUI/enterprise Id/String/../ */
12| Vendor ID Type TAG length
16| Vendor data Length
20| Vendor data (Opaque)
X   | pcap-ng specified options
X+m | Block total lenght

Perhaps two vendor/private blocks one per file and one intermingled with packet blocks ?

Just my 2 c
Regards
Anders
-----Original Message-----
From: pcap-ng-format-bounces at winpcap.org [mailto:pcap-ng-format-bounces at winpcap.org] On Behalf Of Guy Harris
Sent: den 28 juli 2014 11:52
To: Pcap-ng file format
Subject: Re: [pcap-ng-format] Comments for unknown blocks [was Re: opsarea presentation?]


On Jul 28, 2014, at 2:35 AM, Michael Tuexen <tuexen at wireshark.org> wrote:

>> This raises in fact another question: it may be useful, in unknown blocks, to reserve some space for something like a company ID, more or less the same way used to define the Ethertype in Ethernet LLC/SNAP (you have to specify the company OUI, which gives you the meaning of the ethertype field).
>> For me, given that we have 32 bits for the block ID, we can reserve 24 for the company OUI, leaving 7 bits for custom-made fields (the last is used to say that this is a private block).
> 
> That requires that the company has an OUI...

And the organization might not be a company.

And an OUI is cheap at, err, umm, 1/100 of the price:

	http://standards.ieee.org/develop/regauth/oui/index.html

"This product was previously referred to as an OUI (Organizationally Unique Identifier) and is still referred to as such in many standards. OUI is an IEEE Registration Authority (RA) specific term that is referred to in various standards and may be used to identify companies on the IEEE Public Listing. A MA-L assignment includes an OUI and the right to generate various extended identifiers based on that OUI. It is most often used to create IEEE 802-defined MAC addresses (EUI-48 and EUI-64)."

And a public MA-L costs USD 2500.  (And that's if you don't want to keep the assignment private; *that* costs an addition USD 2890 *per year*.)

A "company ID", however, is only USD 625 (plus, if you want it kept private, USD 1015 per year):

	http://standards.ieee.org/develop/regauth/cid/index.html

They're not exactly heavily used:

	http://standards.ieee.org/develop/regauth/cid/cid.txt
_______________________________________________
pcap-ng-format mailing list
pcap-ng-format at winpcap.org
https://www.winpcap.org/mailman/listinfo/pcap-ng-format