On Apr 26, 2012, at 11:06 AM, Bill Meier wrote:
> Can pcapng files also be given a mime-type of application/vnd.tcpdump.pcap ?
In theory, although there should really be a new application/vnd.tcpdump.pcapng
type or something such as that, as the application/vnd.tcpdump.pcap definition:
http://www.iana.org/assignments/media-types/application/vnd.tcpdump.pcap
explicitly speaks only of pcap. At least as I read section 4.4
"Canonicalization and Format Requirements" of RFC 2488
http://tools.ietf.org/html/rfc4288#section-4.4
"All registered media types MUST employ a single, canonical data format,
regardless of registration tree.
A precise and openly available specification of the format of each media type
MUST exist for all types registered in the standards tree and MUST at a minimum
be referenced by, if it isn't actually included in, the media type registration
proposal itself."
pcap-ng should have a separate media type, as it's a different data format from
pcap.
In practice, people will probably be using the same programs to read both file
types (any program that reads only one such file format should either be
upgraded to handle both or just use libpcap so that with libpcap 1.1.0 or later
it can read pcap-ng files to some degree), so it might not make a difference.
For now, my inclination would be to use application/octet-stream. We could, I
guess, use an x. type for now:
http://tools.ietf.org/html/rfc4288#section-3.4
with a registered type for pcap-ng coming later.
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <[email protected]>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:[email protected]?subject=unsubscribe
