Subject: [OPSAWG] 🔔 WG Adoption Call for draft-gharris-opsawg-pcap-02

From: Henk Birkholz <[email-masked]>
Date: Mon, 4 Oct 2021 22:00:27 +0200

Dear OPSAWG members,

this starts a call for Working Group Adoption of

> https://datatracker.ietf.org/doc/html/draft-gharris-opsawg-pcap-02

ending on Monday, October 18th.

As a reminder, this I-D describes the current definition of the PCAP 
format that has been the industry's de-facto packet capture format since 
the 1980s.

Please reply with your support and especially any substantive comments 
you may have.

For the OPSAWG co-chairs,

Henk

---

From: Michael Richardson <[email-masked]>
Date: Mon, 04 Oct 2021 16:53:22 -0400

This document is intended to be Informational.
One thing that I'd like the WG to consider is whether it should go straight
to Historical.  (There is precedent)

This document needs to go through IETF consensus in order to be able to
create the IANA registries that pcapng needs.

[ps: I hate the name "pcapng", and I'd love another name. I suggest pcap20]

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Guy Harris <[email-masked]>
Date: Mon, 4 Oct 2021 14:29:08 -0700

> ending on Monday, October 18th.

There's one small change that should be made to clarify the format of the last field in the file header - it's a field that's in the byte order of the host that wrote it and that, when converted to the byte order of the host that's *reading* it, has the link-layer type in the lower 16 bits and other information in the upper 16 bits.  See

	https://github.com/pcapng/pcapng/issues/106

(Michael Richardson filed it based on a private email to Michael and me).

I'd also like to ask Van Jacobson and Steve McCanne whether they'd like to be included as the first two authors, as they're the creator of the file format (it's undergone some small tweaks since then, such as adding the nanosecond-resolution format and the reinterpretation of the upper 16 bits of the link-layer type, but the credit goes to them) - and to ask if they have any comments on it.  (I don't know if they're on OPSAWG; if so, and you notice this message, please speak up.)

---

From: Michael Richardson <[email-masked]>
Date: Wed, 20 Oct 2021 12:40:36 -0400

> ending on Monday, October 18th.

https://mailarchive.ietf.org/arch/msg/opsawg/4Cvm_msdnORHMUY3kbyCV6dbGyI 
is a very long thread about adoption from November 2020.

There were many suggestions at the time from many people on the CC.

It would be great if you could comment on the current plan.

---

From: Henk Birkholz <[email-masked]>
Date: Wed, 20 Oct 2021 22:22:18 +0200

Dear OPSAWG members,

this email *extends* the ongoing call for Working Group Adoption on 
https://datatracker.ietf.org/doc/html/draft-gharris-opsawg-pcap-02 until 
*Sunday, October 24th*.

We did not reach a critical mass of positive replies - as a result, I'll 
grant a grace period until the end of the week. If you are interested in 
this work, please reply with your support on this list until *Sunday, 
October 24th*.

Henk

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 20 Oct 2021 22:44:37 +0200

On 2021-10-20, at 22:22, Henk Birkholz <[email-masked]> wrote:
> 
> this email *extends* the ongoing call for Working Group Adoption on https://datatracker.ietf.org/doc/html/draft-gharris-opsawg-pcap-02 until *Sunday, October 24th*.

I believe WG time spent to get an authoritative description of this widely used format published as an RFC, with some of the original players being involved, is time spent very well.
I advocate adoption of this draft.

Grüße, Carsten

---

From: Jürgen Schönwälder <[email-masked]>
Date: Wed, 20 Oct 2021 22:46:39 +0200

+1

/js

On Wed, Oct 20, 2021 at 10:44:37PM +0200, Carsten Bormann wrote:
> _______________________________________________
> OPSAWG mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsawg

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <https://www.jacobs-university.de/>

---

From: Eliot Lear <[email-masked]>
Date: Thu, 21 Oct 2021 09:48:56 +0200

+1.

---

From: Michael Richardson <[email-masked]>
Date: Mon, 25 Oct 2021 12:27:32 -0400

> It would be great if you could comment on the current plan.

A number of you spoke up last week about pcapng in this thread.
Can you clarify if your support was for the pcapng only document, or for 
both pcap and pcapng?

---

From: Carsten Bormann <[email-masked]>
Date: Mon, 25 Oct 2021 20:23:01 +0200

On 2021-10-25, at 18:27, Michael Richardson <[email-masked]> wrote:
>> https://mailarchive.ietf.org/arch/msg/opsawg/4Cvm_msdnORHMUY3kbyCV6dbGyI is a very long thread about adoption from November 2020.
> Can you clarify if your support was for the pcapng only document, or for both pcap and pcapng?

Both (if we manage not to entangle them too much, one is a very different effort from the other).

Grüße, Carsten

---

From: Henk Birkholz <[email-masked]>
Date: Mon, 25 Oct 2021 22:56:40 +0200

Dear OPSAWG members,

this email concludes the call for Working Group Adoption on 
https://datatracker.ietf.org/doc/html/draft-gharris-opsawg-pcap-02.

We received a minimal amount of positive replies, no objections, and a 
few elaborate comments.

The chairs believe this I-D is ready for adoption and for the working 
group to work on. As the response was not overwhelming, I want to 
highlight that this is an extensive document that can only progress with 
sufficient review. Please bear in mind that some steady progress is 
required.

Authors, please rename the I-D to draft-ietf-opsawg-pcap-00, keeping the 
content as is, and resubmit.

Henk

---

From: Vladimir Vassilev <[email-masked]>
Date: Tue, 26 Oct 2021 11:05:52 +0200

> for both pcap and pcapng?

I support both pcap and pcapng. My potential use-case is for the 
draft-vassilev-bmwg-network-interconnect-tester-07 where we might need 
alternative binary formats for reading the capture buffers in addition 
to the format specified with a YANG data model.

I am also in support of only doing minor editorial changes to the 
submitted documents during the IETF process. That said I do not think 
there is anything preventing the work group to semantically change the 
drafts once they are adopted. I just do not see a good reason for this.

/Vladimir