IETF Logo Mail Archive

Re: [OPSAWG] New Version Notification for draft-tuexen-opsawg-pcapng-02.txt

Guy Harris <gharris@sonic.net> Wed, 30 September 2020 07:25 UTC

Return-Path: <gharris@sonic.net>
X-Original-To: opsawg@ietfa.amsl.com
Delivered-To: opsawg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78D7D3A1297 for <opsawg@ietfa.amsl.com>; Wed, 30 Sep 2020 00:25:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.897
X-Spam-Level:
X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LpJObsbOP67u for <opsawg@ietfa.amsl.com>; Wed, 30 Sep 2020 00:25:05 -0700 (PDT)
Received: from c.mail.sonic.net (c.mail.sonic.net [64.142.111.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3BB6D3A1295 for <opsawg@ietf.org>; Wed, 30 Sep 2020 00:25:04 -0700 (PDT)
Received: from [192.168.42.85] (173-228-4-241.dsl.dynamic.fusionbroadband.com [173.228.4.241]) (authenticated bits=0) by c.mail.sonic.net (8.15.1/8.15.1) with ESMTPSA id 08U7OqsD030129 (version=TLSv1.2 cipher=DHE-RSA-AES128-GCM-SHA256 bits=128 verify=NOT); Wed, 30 Sep 2020 00:24:53 -0700
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\))
From: Guy Harris <gharris@sonic.net>
In-Reply-To: <B8F9A780D330094D99AF023C5877DABAADA34718@dggeml531-mbs.china.huawei.com>
Date: Wed, 30 Sep 2020 00:24:52 -0700
Cc: Michael Richardson <mcr@sandelman.ca>, Michael Tuexen <tuexen@fh-muenster.de>, "pcap-ng-format@winpcap.org" <pcap-ng-format@winpcap.org>, "opsawg@ietf.org" <opsawg@ietf.org>, Jasper Bongertz <jasper@packet-foo.com>, "tcpdump-workers@lists.tcpdump.org" <tcpdump-workers@lists.tcpdump.org>, Fulvio Risso <fulvio.risso@polito.it>, Gerald Combs <gerald@wireshark.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <6695A7D1-54FC-4288-87F3-F952AFE42D23@sonic.net>
References: <B8F9A780D330094D99AF023C5877DABAADA34718@dggeml531-mbs.china.huawei.com>
To: Qin Wu <bill.wu@huawei.com>
X-Mailer: Apple Mail (2.3608.120.23.2.1)
X-Sonic-CAuth: UmFuZG9tSVbxKpmq4rPl8oimYRaKClbJYHId39+Cg6PwFk5enXWAizEaeMiILDq27CLPXx/HKii73gMJ67+VzZBnp3I5NFcc
X-Sonic-ID: C;op4QCO4C6xG4TZLwCB/Veg== M;9i9dCO4C6xG4TZLwCB/Veg==
X-Sonic-Spam-Details: 0.0/5.0 by cerberusd
Archived-At: <https://mailarchive.ietf.org/arch/msg/opsawg/CcChxLV85-kdBzJBTdmcj7VWu8A>
X-Mailman-Approved-At: Wed, 30 Sep 2020 00:39:39 -0700
Subject: Re: [OPSAWG] New Version Notification for draft-tuexen-opsawg-pcapng-02.txt
X-BeenThere: opsawg@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: OPSA Working Group Mail List <opsawg.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/opsawg>, <mailto:opsawg-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/opsawg/>
List-Post: <mailto:opsawg@ietf.org>
List-Help: <mailto:opsawg-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/opsawg>, <mailto:opsawg-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 30 Sep 2020 07:25:06 -0000

On Sep 29, 2020, at 7:14 PM, Qin Wu <bill.wu@huawei.com> wrote:

> Can you clarify what functionalities is missed for more modern applications? Since it is enhancement to libpcap, do you expect all the future packet capture tools support the format defined in this draft?

pcapng is a file format that's a replacement for pcap.

The current version of libpcap can read some pcapng files, but it only shows what can be shown through the existing pcap API, so most of the enhancements don't make a difference to programs using libpcap.  That version of libpcap cannot *write* pcapng files.

macOS's version of libpcap has undocumented APIs that allow macOS's tcpdump to read and write pcapng files.

Wireshark doesn't use libpcap to read capture files; it fully supports reading and writing pcapng files.

In the future, we would like to add new APIs to libpcap that support reading and writing pcapng files (and pcap files as well); the new APIs will make all of the added capabilities of pcapng available.  However, programs that use libpcap will have to be changed to use the new APIs in order to use those added capabilities.  tcpdump will probably be the first program updated to use them.

v2.23.0 | Report a Bug | By Email