Re: Printing PPI packets

[Guy Harris <guy () alum mit edu>]

On May 5, 2011, at 5:20 PM, Darren Reed wrote:

> In the breakup where you were suggesting 10 bits that could be an organization ID, reserve "0" for the publicly 
> recognised set

That's already done (implicitly, by virtue of those bits being 0 in existing LINKTYPE_ values, and explicitly as well).

> and all 1's for private/experimental.

Sounds good, although it is somewhat redundant with LINKTYPE_USERn (presumably "private/experimental" means "multiple 
organizations can use the same value for different purposes, so don't request that the tcpdump/Wireshark/etc. 
developers put into their official releases anything that assigns a particular interpretation to any of those values").

> Is 10 bits enough for an organisation ID? How many organisations have received a number for use with SNMP? I'm not 
> saying that as many organisations will need an identifier here but rather that the number of organisations might be 
> larger than you would suspect at first.

Well, given that the other bits I took aren't necessary for pcap-ng, we could use the reserved field in the existing 
IDB for an organization code, and, if and when we get above 1023 organizations, say "sorry, usable only in pcap-ng".  
If by "how many organisations have received a number for use with SNMP?" you mean "how many organizations have SMI 
Network Management Private Enterprise Codes?", the answer is "probably somewhere around 37,891, modulo holes in the 
number space" as of today:

        http://www.iana.org/assignments/enterprise-numbers

Using IEEE OUI's would require 24 bits, leaving only 8 bits for existing LINKTYPE_ values, and we're already up to 238, 
so that's not acceptable.  Besides, OUIs cost a minimum of USD 1,750:

        http://standards.ieee.org/develop/regauth/oui/index.html

which is another reason not to use them.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.