Re: MIME type for libpcap-format capture files

[Jefferson Ogata <Jefferson.Ogata () noaa gov>]

On 2008-12-12 16:01, Phil Vandry wrote:
> I agree with Guy, the version is not necesary. At most I could imagine
> a version parameter ("Content-Type: application/pcap-capture; version=1")
> but even that is not necesary: the version will surely be unambiguously
> distinguishable by examining the beginning of the file (magic number).

I still think current and "ng" pcap formats should be distinguished in 
MIME type name. The ng format carries a lot more metadata, and handling 
of it by applications is potentially quite different from handling of 
current pcap files. We're talking about something like the difference 
between a PCM audio file and AIFF. Applications might be interested 
specifically in metadata rather than packets, and should be able to 
indicate this preference in an Accept header.

I also think "ng" is fine for talking about the new format now, but 
someday, when we have been using ng for some time, we may well be 
looking at yet another version. Using "ng" as a notation doesn't help us 
then. Numbered, or at least absolutely named, versions indicate forethought.

But, you know, whatever. I'll be moderately surprised if ng ever comes 
to fruition, frankly.

--
Jefferson Ogata <Jefferson.Ogata () noaa gov>
NOAA Computer Incident Response Team (N-CIRT) <ncirt () noaa gov>
"Never try to retrieve anything from a bear."--National Park Service
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.