MIME type for libpcap-format capture files

[Phil Vandry <vandry () TZoNE ORG>]

Hello tcpdump-workers,

I noticed that there does not seem to be any MIME type defined for
libpcap-format packet capture files according to the list of types
maintained by IANA:

http://www.iana.org/assignments/media-types/

I couldn't find any well-known but unofficial MIME type either. It
seems there is no concensus on what the MIME type of these files
should be.

Since the format is widely used by several applications, it would be
very useful if there was a well-known type defined, unofficial or not.
It's critical for enabling software to automatically open an
appropriate application automatically when one of these files is
encountered (web browsers, desktop file managers, etc...).

As an example, consider a packet capture file served from a web
server. The type might be the generic "application/octet-stream", in
which case the browser will probably prompt the use to save the file
and not open any application; or the type might be a non-standard
invented type such as "application/x-libpcap-capture". In the latter
case, the browser will probably have never heard of this type before
and the user must manually choose an action (e.g. open in Wireshark),
although the browser will subsequently be able to remember and reuse
the type<->application association.

As the owners of the libpcap file format, I would like to encourage
the tcpdump developpers to choose a MIME type for the format and
publicize it. There are two options:

- Choose an unofficial type such as "application/x-libpcap-capture"
  and advertize it.

- Endorse an application to IANA for an official type such as
  "application/libpcap-capture" to be published in the media-types
  database.

Either way, applications such as Wireshark will hopefully pick up on
the new type and install system mappings for this type when installing
themselves.

FYI, here is an example definition for a type
"application/x-libpcap-capture" that can be installed in the
freedesktop.org shared MIME-info database (see

http://standards.freedesktop.org/shared-mime-info-spec/shared-mime-info-spec-latest.html

). It allows desktop file managers to automatically identify capture
files.

<?xml version="1.0" ?>
<mime-info xmlns="http://www.freedesktop.org/standards/shared-mime-info";>
  <mime-type type="application/x-libpcap-capture">
    <comment>tcpdump capture file</comment>
    <magic>
      <match offset="0" type="big32" value="0xa1b2c3d4"/>
      <match offset="0" type="little32" value="0xa1b2c3d4"/>
    </magic>
  </mime-type>
</mime-info>

-Phil
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.