draft-gharris-opsawg-pcap.txt --- IANA considerations

[Michael Richardson via tcpdump-workers <tcpdump-workers () lists tcpdump org>]

> --- Begin Message ---
>
>
> From: Michael Richardson <mcr+ietf () sandelman ca>
>
> Date: Mon, 21 Dec 2020 20:51:10 -0500
>
>
> The short of it is:
>
> 1) reserve bits 16:28 of linktype as zero.
> 2) lower 32K Specification Required (any document),
>    upper 32K First Come First Served
>
> Details:
>   The Registry has three sections according to {{RFC8126}}:
>   * values from 0 to 32767 are marked as Specification Required.
>   *   except that values 147 to 162 are reserved for Private Use
>   * values from 32768 to 65000 are marked as First-Come First-Served.
>   * values from 65000 to 65536 are marked as Private Use.
>
> 3) I have included the tcpdump.org linktype database that we maintain.
>    It might be a week old, but I don't think we've allocated anything
>    in the past month.
>    It is at: http://www.tcpdump.org/linktypes.html
>    Some entries have further links under /linktypes/... which we could
>    enter as the correct reference.
>    There are 112 entries.
>    It may be that we should do something different for initializing IANA.
>
> I did some editing of the description field to shorten in a lot, but I got
> tired about 30% through the list, not sure if we should even include that
> column.
> There are many entries like:
>    LINKTYPE_PPP_ETHER                  |   51   |PPPoE; per RFC 2516
>
> where I think that maybe this should point directly at RFC2516.
> I'm not entirely sure about this.
>
> Where this gets more complex is:
>    LINKTYPE_PPP_WITH_DIR        204     DLT_PPP_WITH_DIR        PPP, as per
>    RFC 1661 and RFC 1662, preceded with a one-byte pseudo-header with a zero
>    value meaning "received by this host" and a non-zero value meaning "sent
>    by this host"; if the first 2 bytes are 0xff and 0x03, it's PPP in
>    HDLC-like framing, with the PPP header following those two bytes,
>    otherwise it's PPP without framing, and the packet begins with the PPP
>    header. The data in the frame is not octet-stuffed or bit-stuffed.
>
> in this case, the text in linktypes.html is probably most appropriate.
>
>
> Name:           draft-gharris-opsawg-pcap
> Revision:       01
> Title:          PCAP Capture File Format
> Document date:  2020-12-22
> Group:          Individual Submission
> Pages:          29
> URL:            https://www.ietf.org/archive/id/draft-gharris-opsawg-pcap-01.txt
> Status:         https://datatracker.ietf.org/doc/draft-gharris-opsawg-pcap/
> Html:           https://www.ietf.org/archive/id/draft-gharris-opsawg-pcap-01.html
> Htmlized:       https://tools.ietf.org/html/draft-gharris-opsawg-pcap-01
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-gharris-opsawg-pcap-01
>
>
> --
> Michael Richardson <mcr+IETF () sandelman ca>   . o O ( IPv6 IøT consulting )
>            Sandelman Software Works Inc, Ottawa and Worldwide
>
>
>
>
>
> --- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers