[pcap-ng-format] Proposal for flow/encryption stuff

[Michael Haney]

On August 27, 2015 8:49:51 AM MDT, Hadriel Kaplan <
the.real.hadriel at gmail.com> wrote:
>
> Hi,
> Before commenting on the specific proposals, one thing I noticed is
> that for two of the blocks you're using Block Type codes with the MSB
> set. In one of the proposals you said this was because it was
> experimental. But the number range with MSB set is for local use only
> - not for sharing files across systems. For example we can't reserve
> numbers in that space in the format spec, because the whole point of
> that number range was essentially to be "undefined local use".
>
> But that's not why I raised this topic - the reason I'm mentioning it
> is: is this mechanism experimental? For example do you expect it to
> need to change based on real-world use? Because if it is experimental,
> then I think you should just use a Custom Block and Custom Options,
> using your own PEN, and create a separate doc for what it all
> means/does if you want other folks to use it - or don't publish that
> info if you don't want them to. Then if/when it becomes no longer
> experimental, you can either ask for standard type codes, or even just
> keep using the Custom Block/Options with your PEN.
>
> -hadriel
>
>
Yes, that local-use-only MSB was how I have been using it, and up until
this week, only local colleagues have been working on it. But I'd like to
get it rolled into the official spec with a publicly shared block type
assignment. I'd say it's in the process of transitioning out of the
experimental phase. So I need a new block type number assignment if it is
accepted by the community. Any suggestions?

I need to go back and read again, but probably at this stage I should
switch to custom block numbers and release the code for wider testing and
feedback and 'unset' the MSB.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/pcap-ng-format/attachments/20150827/5f2710aa/attachment.html>