[Qlog] qlog in pcap-ng format

[Michael Richardson <[e-mail]>]

I saw part of this presentation a few weeks ago someplace.
I just watched the SAAG recording.

1) I think that JSON is too verbose for this stuff, but I think that CBOR
   (described by CDDL) is probably exactly right for what you are doing.

2) PCAP-NG, which wireshark reads/writes, and libpcap only reads,
   accomodates a multitude of different streams and formats, not just
   ethernet dumps.
   (We have USB captures, nflog captures, and stuff all sorts of
   instruments).

PCAP and PCAP-NG are candidates for adoption by the OPSAWG, but if
QUIC would like to adopt them, that's okay with me.

I think that there is a significant value here, particular when there may be
a need to capture both TCP, UDP and internal logic at the same time.
Imagine something doesn't work, because something is eating UDP packets with
a particular checksum (or ethernet CRC).  It's happened more than once.
Having the internal state that says, "I retransmitted foo", and then the
capture from end A, that shows the encrypted QUIC packet going out, and
then the capture from end B, which says, "I didn't get foo, I asked for it
again"
would be very useful to see.  That requires merging streams from both ends,
and interleaving actual captured traffic at the same time.
(And still doesn't require access to cleartext to debug)

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide