[pcap-ng-format] Proposal for new "custom" option codes

[Hadriel Kaplan]

On Wed, Jul 22, 2015 at 10:22 AM, Jasper Bongertz <jasper at packet-foo.com> wrote:
> Out of curiosity - how/why did you choose those four option code
> numbers?

Originally I was going to propose 256/257, but I found someone's
already squatted on those [1]. So I picked something seemingly more
random.

For the "do-not-copy" variants, the numbers are based on the same
numbers 2988/2989, except that the next-to-most-significant-bit is
set. (i.e., it went from 0x0BAC/0x0BAD to 0x4BAC/0x4BAD)

The reason I did that is I was expecting we'd eventually want to use a
bit to mean "do-not-copy", even for other option codes. For example
the opt_comment, or ns_dnsname, or whatever. So I made the numbers
consistent with that.

-hadriel
[1] https://github.com/HoneProject/Linux-Sensor/wiki/Augmented-PCAP-Next-Generation-Dump-File-Format