Re: MIME type for libpcap-format capture files

[Phil Vandry <vandry () TZoNE ORG>]

On Thu, Oct 16, 2008 at 09:07:17AM -0700, Gerald Combs wrote:
> Debian and Ubuntu have the following entry in /etc/mime.types:
>
> application/cap                                 cap pcap

It's a start but I don't agree with the choice of type. First they
ignored the specification which clearly says that only types registered
with IANA or published as RFCs can be named without the "x-" prefix
(see RFC2045 section 5.1). Second and perhaps more importantly,
"cap" is a poor description...

> I prefer "application/x-libpcap-capture" since it's more descriptive. Would it

...as you already point out.

Besides, Wireshark does not come with a .desktop entry or mailcap entry
that registers it as a handler for this type, so it doesn't enable
you to double click on such files and have Wireshark launch. Since
Wireshark is probaly the most popular desktop application that uses
libpcap files, that indicates to me that adoption of this type is poor.

Since libpcap captures are a well-established and popular filetype I
would like to undertake the full IANA process for an officially
registered type but I hope it's not too daunting.

> make sense to have an "application/x-libpcap-ng-capture" type for Pcap-NG/NTAR
> as well?

That's a good question. I'm not familiar with Pcap-NG so I will let
others answer but I suggest asking the question, "is a user likely
to need different treatment for Pcap-NG files or is the user likely
to consider Pcap-NG and plain Pcap to be substantially different
types?". If the answer is no, I recommend that they share the same
MIME type.

-Phil
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.