[pcap-ng-format] Cleanup of the PCAP-NG spec

[Jasper Bongertz]

Wednesday, November 16, 2016, 1:44:27 PM, Erik Hjelmvik wrote:

>> I have no interest in working on pcapng, or code that reads or
>> writes it, if we're going to change the spec to this degree.  If we
>> start changing to this degree, I'm out.
>  
> This is exactly the reaction that I've been afraid of getting when
> expressing my concerns for the pcapng specification. It is also the
> reason for why I have restrained myself from discussing this matter
> in this group earlier.

First of all I want to say I respect both points of view, but I don't
want to lose either of you working on this together (and anyone else
offering constructive ideas - not all of them can always be accepted,
but that doesn't mean they're bad ideas in themselves).

While PCAPng may not be perfect in its treatment of endianess when it
comes to the current code writing state-of-the-art I think we should
focus on getting what we have to a final spec without a major base
code overhaul. Because that would probably mess with all the existing
implemetations so far. And we might end up kinda like this:
https://xkcd.com/927/ ;-)

I think if we can compromise on not touching endianess, at least for
the time being, and fix the remaining issues as well as removing
obsolete block types, a final spec should be doable.

Cheers,
Jasper
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3283 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://www.winpcap.org/pipermail/pcap-ng-format/attachments/20161117/124e07e3/attachment.bin>