[pcap-ng-format] Cleanup of the PCAP-NG spec

[Michael Richardson]

Guy Harris <guy at alum.mit.edu> wrote:
    >> I think that it just hasn't been a priority for libpcap to move towards
    >> writing pcapng by default.  That's what we need to get to.  This means
    >> knowing that libpcap 1.x can read pcapng format well enough that nobody will
    >> be excessively annoyed by a libpcap 2.x that writes in a different format by
    >> default.

    > (Well, I'm not sure I'd want to have a "2.0" release of libpcap, if it
    > ended up getting a shared-library version number of 2.x.  The goal
    > should be to keep the releases source-compatible and binary-compatible
    > with previous releases, so that a program written to the libpcap 0.4
    > API will still work with the libpcap that fully supports pcapng, even
    > if full support of all of pcapng's capabilities *in the application*
    > requires API changes, and so that a program compiled against the
    > libpcap in an older release of $OPERATING_SYSTEM will still run in a
    > newer release that has a newer $OPERATING_SYSTEM.)

I agree with all your points....
I'd like to have an ongoing build of libpcap 1.x that has a compatible 0.4
API, and have a libpcap 2.x with a different API that includes the things we
really really need.

    > But, yes, we do need reading-API changes to provide full support of
    > pcapng's capabilities, and changes to support writing pcapng.  Tcpdump
    > should probably start out defaulting to pcap, with a -P flag to get it
    > to write pcapng, just as Apple's version of tcpdump has.  At some point
    > we could switch to defaulting to pcapng, although it probably
    > shouldn't switch to using -P to mean "write pcap", as that'd be too
    > confusing.

I agree with this plan.... I just don't know how to get the critical mass to
make it so.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        | network architect  [
]     mcr at sandelman.ca  http://www.sandelman.ca/        |   ruby on rails    [




--
Michael Richardson <mcr+IETF at sandelman.ca>, Sandelman Software Works
 -= IPv6 IoT consulting =-



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 472 bytes
Desc: not available
URL: <http://www.winpcap.org/pipermail/pcap-ng-format/attachments/20161116/2c4fb6e7/attachment-0001.pgp>