[OPSAWG]Re: Ketan Talaulikar's Discuss on draft-ietf-opsawg-pcaplinktype-12: (with DISCUSS and COMMENT)

[[e-mail]]

Hi Ketan, all,

I agree with Guy here.

The definition of LinkType should be decorrelated from the actual format used to capture packet traces. The dependency is actually in the other way around (via the registry of course, as this doc is populating the initial version).

Cheers,
Med

De : Guy Harris <[e-mail]>
Envoyé : jeudi 16 octobre 2025 10:50
À : Ketan Talaulikar <[e-mail]>
Cc : The IESG <[e-mail]>; [e-mail]; opsawg-chairs <[e-mail]>; opsawg <[e-mail]>
Objet : Re: [OPSAWG]Ketan Talaulikar's Discuss on draft-ietf-opsawg-pcaplinktype-12: (with DISCUSS and COMMENT)



On Oct 16, 2025, at 12:36 AM, Ketan Talaulikar <[e-mail]<mailto:[e-mail]>> wrote:

CURRENT:
Within those file formats each packet that is captured is indicated by a LinkType value. The LinkType value selects one of many hundred formats for metadata and Layer 2 encapsulation of the packet.

That is a correct statement.


SUGGEST:
Within those file formats each packet that is captured is indicated by a LinkType value. The LinkType value selects one of many hundred formats for metadata and Layer 2 encapsulation of the packet. [I-D.ietf-opsawg-pcap<https://www.ietf.org/archive/id/draft-ietf-opsawg-pcaplinktype-12.html#I-D.ietf-opsawg-pcap>] describes the format and the encoding of LinkType. The use of LinkType in other encoding schemes for other tools is not precluded by this document.

That is an incorrect statement, so it would be an error to put it into ietf-opsawg-pcaplinktype.

What ietf-opsawg-pcap describes is the format of a capture file that happens to include, in its file header, a field name LinkType, the value of which is one of the LinkType values in the table in ietf-opsawg-pcaplinktype.

ietf-opsawg-pcap does not, and should not, describe the format corresponding to any LinkType value, nor should it enumerate the allowed values for LinkType.

Furthermore, not all instances of LinkType values appear in the file header of a PCAP file. Many of them - for example, just about all of the ones saved in captures from Wireshark or TShark - are in PCAP Now Generic files, the format of which is described in ietf-opsawg-pcapng.
____________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.