Hi Guy, Let me try to clarify with a text suggestion:
CURRENT: Within those file formats each packet that is captured is indicated by a LinkType value. The LinkType value selects one of many hundred formats for metadata and Layer 2 encapsulation of the packet. SUGGEST: Within those file formats each packet that is captured is indicated by a LinkType value. The LinkType value selects one of many hundred formats for metadata and Layer 2 encapsulation of the packet. [I-D.ietf-opsawg-pcap <https://www.ietf.org/archive/id/draft-ietf-opsawg-pcaplinktype-12.html#I-D.ietf-opsawg-pcap>] describes the format and the encoding of LinkType. The use of LinkType in other encoding schemes for other tools is not precluded by this document. Then move [I-D.ietf-opsawg-pcap <https://www.ietf.org/archive/id/draft-ietf-opsawg-pcaplinktype-12.html#I-D.ietf-opsawg-pcap> ] to normative references. Thanks, Ketan On Thu, Oct 16, 2025 at 11:31 AM Guy Harris <[email protected]> wrote: > On Oct 15, 2025, at 10:38 PM, Ketan Talaulikar <[email protected]> > wrote: > > KT2> I think I am beginning to understand this better now. Thanks for your > explanation. All I am looking for is some normative reference for this code > point (preferably in an IETF consensus document). > > > At least according to the "Code point" Wikipedia article at > https://en.wikipedia.org/wiki/Code_point, a "code point ... is a > particular position in a table, where the position has been assigned a > meaning". > > So, if we're referring to LinkType values, there isn't a single code point > here, there is a set of code points, i.e. a set of LinkType values. > > If by "some normative reference" you mean a reference that specifies, for > each of those code points, the format of packets for that code point, > draft-ietf-opsawg-pcaplinktype > is the draft for that reference; the details of each of those formats is > given by the references for each of those code points. > > Neither the pcap nor pcapng drafts are references for the LinkType code > points. They are references for file formats that contain fields that use > those code point values.There *is* no other reference for the > code-point-to-format mapping to which draft-ietf-opsawg-pcaplinktype can > refer - draft-ietf-opsawg-pcaplinktype *is* the reference for that > mapping. > > Others are free to use/leverage the same. > > > Yes, formats other than pcap and pcapng that use LinkType values, and > network protocols using LinkType values, can also refer to the registry > created based on draft-ietf-opsawg-pcaplinktype. > > I will wait for an updated document or text proposal. > > > What updates are required here? >
_______________________________________________ OPSAWG mailing list -- [email protected] To unsubscribe send an email to [email protected]
