Re: [OPSAWG] [pcap-ng-format] draft-gharris-opsawg-pcap.txt --- IANA considerations

[Guy Harris <[e-mail]>]

On Dec 22, 2020, at 8:36 AM, Michael Richardson <[e-mail]> wrote:

> Guy Harris <[e-mail]> wrote:
> 
>> And, as per my idea of using 65535 to mean "custom linktype", similar
>> to pcapng custom blocks and options, with either:
> 
> I'm happy with this proposal, but isn't it pcapng specific?

No - it's *cleaner* to implement in pcapng, as you can use Interface Description Block (IDB) options to provide the Private Enterprise Number (PEN) and an enterprise-specific encapsulation type, but:

	if we go with the PEN and and enterprise-specific encapsulation type with IDB options, for pcap we can steal the former time stamp offset (Reserved1) and time stamp accuracy (Reserved2) fields, interpreting them as the PEN and enterprise-specific encapsulation type, respectively, if the link type is 65535;

	if we go with the PEN as an IDB option, and say that if an enterprise wants more than one encapsulation type, they'd have to put a encapsulation type at the beginning of the payload, so, for pcap, we'd steal the former time stamp offset (Reserved1), interpreting it as the PEN if the link type is 65535;

	if we go with putting the PEN and encapsulation type at the beginning of the payload, that would work the same way for pcap as it does for pcapng.