Current pcap draft doesn't include all the link types

IETF-OPSAWG-WG / draft-ietf-opsawg-pcap

PCAP next generation file format specification

Other

264 stars 59 forks source link

Current pcap draft doesn't include all the link types #102

Closed kayoub5 closed 3 years ago

kayoub5 commented 3 years ago

The current list of link types contains about 128 link types, unfortunately the list there is incomplete.

The link on tcpdump website defines around 113 link types
pcap-common.c defines around 205 link types

The additional 90 or so link types already defined in pcap-common.c needs to be taken into consideration to prevent conflict.

guyharris commented 3 years ago

The additional 90 or so link types already defined in pcap-common.c needs to be taken into consideration to prevent conflict.

Values in the range DLT_MATCHING_MIN to DLT_MATCHING_MAX, from pcap/dlt.h, are not available for assignment.

We can add "reserved for" entries for the ones that don't have specifications.

kayoub5 commented 3 years ago

Sounds good.

One small detail, DLT_MATCHING_MAX will soon change due to https://github.com/the-tcpdump-group/libpcap/pull/934

guyharris commented 3 years ago

They should be there now. Some ranges are marked as "not to be used".

mcr commented 3 years ago

So, please don't stress about getting everything perfect. We have to get the document adopted (or sponsored), and then have a conversation with IANA about how to transfer this large table. (They may prefer another format) Not that good data isn't better than bad data, I'm just saying: let's get the format right.