[pcap-ng-format] returning to IETF with pcap-ng

[Jasper Bongertz]

Monday, October 1, 2018, 2:05:30 AM, Richard Sharpe wrote:

> On Sun, Sep 30, 2018 at 4:45 PM Michael Richardson <mcr at sandelman.ca> wrote:
>>
>> I think it was IETF 88 or so, in Toronto in 2014 when we last tried to do the
>> standardization dance for pcap-ng.
>>
>> Is there any energy to continue?

> Well, I guess the real question is: Should it be an IETF standard?

> It's a file format, after all.

> What benefit is there to pcap-ng being an IETF standard?

The main benefit would probably be that eventually more tools and vendors
support it. The most common argument against pcap-ng is that it's much more
complex to implement than pcap - and that won't change. As an IETF standard
pcap-ng will at least gain some reputation. If that's important enough to go
through with the standardization dance I don't know.

From my point of view the energy is not that high - for some reason the work on
the specs stalls all the time, which is a problem. I think it's because there is
no defined decision process, meaning that there are many ideas floating around
but nobody dares to make final decisions about what (and what not) to do.