[pcap-ng-format] [OPSAWG] New Version Notification for draft-tuexen-opsawg-pcapng-02.txt

[Guy Harris]

On Sep 29, 2020, at 7:14 PM, Qin Wu <bill.wu at huawei.com> wrote:

> Can you clarify what functionalities is missed for more modern applications? Since it is enhancement to libpcap, do you expect all the future packet capture tools support the format defined in this draft?

pcapng is a file format that's a replacement for pcap.

The current version of libpcap can read some pcapng files, but it only shows what can be shown through the existing pcap API, so most of the enhancements don't make a difference to programs using libpcap.  That version of libpcap cannot *write* pcapng files.

macOS's version of libpcap has undocumented APIs that allow macOS's tcpdump to read and write pcapng files.

Wireshark doesn't use libpcap to read capture files; it fully supports reading and writing pcapng files.

In the future, we would like to add new APIs to libpcap that support reading and writing pcapng files (and pcap files as well); the new APIs will make all of the added capabilities of pcapng available.  However, programs that use libpcap will have to be changed to use the new APIs in order to use those added capabilities.  tcpdump will probably be the first program updated to use them.