Re: tools/svnadd

[Guy Harris <guy () alum mit edu>]

On Apr 26, 2012, at 11:06 AM, Bill Meier wrote:

> Can pcapng files also be given a mime-type of application/vnd.tcpdump.pcap ?

In theory, although there should really be a new application/vnd.tcpdump.pcapng type or something such as that, as the 
application/vnd.tcpdump.pcap definition:

        http://www.iana.org/assignments/media-types/application/vnd.tcpdump.pcap

explicitly speaks only of pcap.  At least as I read section 4.4 "Canonicalization and Format Requirements" of RFC 2488

        http://tools.ietf.org/html/rfc4288#section-4.4

"All registered media types MUST employ a single, canonical data format, regardless of registration tree.

A precise and openly available specification of the format of each media type MUST exist for all types registered in 
the standards tree and MUST at a minimum be referenced by, if it isn't actually included in, the media type 
registration proposal itself."

pcap-ng should have a separate media type, as it's a different data format from pcap.

In practice, people will probably be using the same programs to read both file types (any program that reads only one 
such file format should either be upgraded to handle both or just use libpcap so that with libpcap 1.1.0 or later it 
can read pcap-ng files to some degree), so it might not make a difference.

For now, my inclination would be to use application/octet-stream.  We could, I guess, use an x. type for now:

        http://tools.ietf.org/html/rfc4288#section-3.4

with a registered type for pcap-ng coming later.

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe