On May 5, 2011, at 1:38 PM, Darren Reed wrote:

> In terms of pcap, I'm becoming more and more of the opinion that DLT_PPI 
> should not be used for anything other than DLT_IEEE802_11.

Sounds good to me.

> Why am I not very interested in pcap-ng?
> "The pcapng file format specification is still work in progress, see:"
> 
> ... moving target.

pcap-ng is extensible, so it's *always* going to be a moving target.  However, 
both Wireshark and libpcap read it, so there are limits on how much it can 
move; the spec needs to be clarified to indicate what part isn't going to 
change and what part is.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.

Reply via email to