Subject: [OPSAWG] PCAP NG -- draft-tuexen-opsawg-pcapng-01.txt

From: Michael Richardson <[email-masked]>
Date: Sun, 29 Mar 2020 16:40:37 -0400

Hi, I have reposted this document.
It was first considered by opsawg back in 2014!

There was a lack of people time to bring this forward at the time.
At this point, this fits into my dayjo$.
There has been significant advanced in github, which you can see in the
-00/-01 diff.

Some links to previous conversation:
  https://mailarchive.ietf.org/arch/msg/opsawg/yJ7LczDObabWAH4SrmJ886bqMVg/
  https://mailarchive.ietf.org/arch/msg/opsawg/yNOPXGto0kvgjmRc1HMX1JuVTWs/
  https://www.ietf.org/proceedings/90/slides/slides-90-opsawg-7.pdf
  https://www.ietf.org/proceedings/90/minutes/minutes-90-opsawg
  (We don't seem to have video recordings on youtube for IETFs before 93.
  I remember that I had a conflict during the meeting itself)

I don't know if the WG needs another presentation in order to think more
about this.   We could certainly go AD sponsored or ISE.

I'm cc'ing [email-masked], which may cause some things get
moderated in each direction, sorry.

In addition, there is now a document:
  https://github.com/pcapng/pcapng/blob/master/draft-gharris-opsawg-pcap.xml

which documents the "pcap" format that we've used/maintained for 25 years.
I'm not sure if we have energy to submit to ISE as an Informational RFC.

[email-masked] wrote:
    > A new version of I-D, draft-tuexen-opsawg-pcapng-01.txt
    > has been successfully submitted by Michael Richardson and posted to the
    > IETF repository.

    > Name:		draft-tuexen-opsawg-pcapng
    > Revision:	01
    > Title:		PCAP Next Generation (pcapng) Capture File Format
    > Document date:	2020-03-27
    > Group:		Individual Submission
    > Pages:		55
    > URL:            https://www.ietf.org/internet-drafts/draft-tuexen-opsawg-pcapng-01.txt
    > Status:         https://datatracker.ietf.org/doc/draft-tuexen-opsawg-pcapng/
    > Htmlized:       https://tools.ietf.org/html/draft-tuexen-opsawg-pcapng-01
    > Htmlized:       https://datatracker.ietf.org/doc/html/draft-tuexen-opsawg-pcapng
    > Diff:           https://www.ietf.org/rfcdiff?url2=draft-tuexen-opsawg-pcapng-01

    > Abstract:
    > This document describes a format to record captured packets to a
    > file.  This format is extensible; Wireshark can currently read and
    > write it, and libpcap can currently read some pcapng files.

    > Please note that it may take a couple of minutes from the time of submission
    > until the htmlized version and diff are available at tools.ietf.org.

    > The IETF Secretariat

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-