Re: pcap files with file header snaplen < packet

[Guy Harris <guy () alum mit edu>]

On Dec 4, 2006, at 2:41 PM, Gianluca Varenni wrote:

> ----- Original Message ----- From: "Harley Stenzel" <hstenzel () users sourceforge net 
> >
> > It certainly does, but it expired more than 2 years ago.  Is it  
> > still active?
>
> Although the draft expired 2 yrs ago, and I released some update to  
> the NTAR code back in february, the project is still alive.

In particular, note that, whilst the I-D in question might have  
expired then, it's been updated since then, with the most recent  
update being in September of this year; note the "Updates" section.   
It hasn't been re-submitted; I don't know what plans there are to  
resubmit it, although once it's "done" in the sense that we expect the  
only subsequent changes to be the addition of new block types, new  
block options, and new link-layer types (see Appendix C, although that  
also raises the question of whether the link type codes should be in  
another document), it might be worth re-submitting.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.