Re: [OPSAWG] [pcap-ng-format] draft-gharris-opsawg-pcap.txt --- IANA considerations

[Guy Harris via tcpdump-workers <tcpdump-workers () lists tcpdump org>]

> --- Begin Message ---
>
>
> From: Guy Harris <gharris () sonic net>
>
> Date: Tue, 22 Dec 2020 12:04:57 -0800
>
> On Dec 22, 2020, at 8:36 AM, Michael Richardson <mcr+ietf () sandelman ca> wrote:
>
> > Guy Harris <guy () alum mit edu> wrote:
> >
> > > And, as per my idea of using 65535 to mean "custom linktype", similar
> > > to pcapng custom blocks and options, with either:
> >
> > I'm happy with this proposal, but isn't it pcapng specific?
>
> No - it's *cleaner* to implement in pcapng, as you can use Interface Description Block (IDB) options to provide the 
> Private Enterprise Number (PEN) and an enterprise-specific encapsulation type, but:
>
>         if we go with the PEN and and enterprise-specific encapsulation type with IDB options, for pcap we can steal 
> the former time stamp offset (Reserved1) and time stamp accuracy (Reserved2) fields, interpreting them as the PEN and 
> enterprise-specific encapsulation type, respectively, if the link type is 65535;
>
>         if we go with the PEN as an IDB option, and say that if an enterprise wants more than one encapsulation type, 
> they'd have to put a encapsulation type at the beginning of the payload, so, for pcap, we'd steal the former time stamp 
> offset (Reserved1), interpreting it as the PEN if the link type is 65535;
>
>         if we go with putting the PEN and encapsulation type at the beginning of the payload, that would work the same 
> way for pcap as it does for pcapng.
>
>
> --- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers