On Oct 16, 2025, at 12:36 AM, Ketan Talaulikar <[email protected]> wrote:
> CURRENT:
> Within those file formats each packet that is captured is indicated by a
> LinkType value. The LinkType value selects one of many hundred formats for
> metadata and Layer 2 encapsulation of the packet.
That is a correct statement.
> SUGGEST:
> Within those file formats each packet that is captured is indicated by a
> LinkType value. The LinkType value selects one of many hundred formats for
> metadata and Layer 2 encapsulation of the packet. [I-D.ietf-opsawg-pcap
> <https://www.ietf.org/archive/id/draft-ietf-opsawg-pcaplinktype-12.html#I-D.ietf-opsawg-pcap>]
> describes the format and the encoding of LinkType. The use of LinkType in
> other encoding schemes for other tools is not precluded by this document.
That is an incorrect statement, so it would be an error to put it into
ietf-opsawg-pcaplinktype.
What ietf-opsawg-pcap describes is the format of a capture file that happens to
include, in its file header, a field name LinkType, the value of which is one
of the LinkType values in the table in ietf-opsawg-pcaplinktype.
ietf-opsawg-pcap does not, and should not, describe the format corresponding to
any LinkType value, nor should it enumerate the allowed values for LinkType.
Furthermore, not all instances of LinkType values appear in the file header of
a PCAP file. Many of them - for example, just about all of the ones saved in
captures from Wireshark or TShark - are in PCAP Now Generic files, the format
of which is described in ietf-opsawg-pcapng.
_______________________________________________
OPSAWG mailing list -- [email protected]
To unsubscribe send an email to [email protected]
