Re: [tcpdump-workers] MIME type for libpcap (tcpdump -w)

2010-11-03 Thread Phil Vandry
On Wed, Nov 03, 2010 at 11:31:30AM +1030, Glen Turner wrote: > I seek consensus for the following, which I have based on discussions on > this subject previously which I have found in the mailing list archive. > The proposed MIME type meets IETF/IANA requirements. Hi Glen, I brought up the subj

Re: [tcpdump-workers] bandwidth by user or process id

2010-10-06 Thread Phil Vandry
On Wed, Oct 06, 2010 at 01:30:14AM -0700, Patrick Kurz wrote: > I was also slightly concerned about short-lived connections. But if the > measured > bandwidth is accurate by 10%, it is sufficient for my use case. > What kind of applications do in general create such short-lived connections > and

Re: [tcpdump-workers] bandwidth by user or process id

2010-10-05 Thread Phil Vandry
On Mon, 4 Oct 2010 09:51:39 -0400 Rob Hasselbaum wrote: > Yes, it is possible (on Linux, anyway), but not extremely easy. You can > correlate packet data to the kernel's network connection table and network > connections to inode values by reading "/proc/net/tcp*" and Isn't that unreliable? The c

Re: [tcpdump-workers] capturing Serial Port with pcap

2009-10-30 Thread Phil Vandry
On 2009-10-28, at 12:06 , Paul B. wrote: I need to simultaneously observe the timing of ethernet traffic and a discrete control signal. For the discrete signal, I was thinking that I could tie the signal to a control signal such as CTS or RTS on the serial port and modify the serial port dri

Re: [tcpdump-workers] How does packet capture interact with firewalls?

2009-09-23 Thread Phil Vandry
On Wed, 23 Sep 2009 16:38:06 -0400, Robert Burgess wrote: > I guess I'm not sure. What I want is a chain of these things so that > each one waits for the previous to pass on the packet, and I don't want > to tie myself down to the topology. On a switched ether, for instance, OK. That definitely

Re: [tcpdump-workers] How does packet capture interact with firewalls?

2009-09-23 Thread Phil Vandry
On Wed, 23 Sep 2009 14:01:53 -0400, Robert Burgess wrote: > iptables firewall) and they still appear in my pcap program (the first > half), but when I try to reinject, depending on what setup I try, either > the injected packets get dropped too, or they get injected correctly but > also recaptured,

[tcpdump-workers] Registration of media type for libpcap-format capture files

2008-12-12 Thread Phil Vandry
Hello, We would like to register a media type (MIME type) for the file format used by the libpcap library ( http://www.tcpdump.org/ ). This file format is widely used by well-known software such as the network packet capturing packages tcpdump and Wireshark but up to now has had no official media-

Re: [tcpdump-workers] MIME type for libpcap-format capture files

2008-12-12 Thread Phil Vandry
On Thu, Dec 11, 2008 at 08:59:57PM -0500, Michael Richardson wrote: > Yeah, application/pcap would be cuter, but may be too terse. > Let's suggest both (or all three), and let the IETF MIME people advise > us. I will suggest both. > ] Y'avait une poule de jammé dans l'muffler!

Re: [tcpdump-workers] MIME type for libpcap-format capture files

2008-12-12 Thread Phil Vandry
On Fri, Dec 12, 2008 at 02:38:43AM +, Jefferson Ogata wrote: > But what I think is missing is a version number. Given the talk in > recent years about implementing the next version, I think the type > should be application/pcap-capture-v1. I agree with Guy, the version is not necesary. At mo

Re: [tcpdump-workers] MIME type for libpcap-format capture files

2008-12-11 Thread Phil Vandry
On Thu, Dec 11, 2008 at 01:14:24PM -0800, Guy Harris wrote: > > On Dec 11, 2008, at 12:26 PM, Michael Richardson wrote: > > > application/pcap-capture [...] > 3) not all pcap-format files are written by libpcap. ...but libpcap may be considered to supply the authoritative definition of t

Re: [tcpdump-workers] MIME type for libpcap-format capture files

2008-12-11 Thread Phil Vandry
Hi tcpdump-workers, As I've now returned from a vacation, I would like to revive this thread. Now that we have a manpage describing the format, I think we are ready to start the ball rolling. I am going to send the following email: To: ietf-ty...@iana.org Cc: tcpdump-workers@lists.tcpdump.org Sub

Re: [tcpdump-workers] MIME type for libpcap-format capture files

2008-10-17 Thread Phil Vandry
On Fri, Oct 17, 2008 at 02:56:11AM -0700, Guy Harris wrote: > > On Oct 16, 2008, at 6:34 PM, Phil Vandry wrote: > > >I was thinking it would belong in the standard tree (RFC4288 3.1). > >This > >requires writing an RFC. > > At least as I read RFC 4288, that ap

Re: [tcpdump-workers] MIME type for libpcap-format capture files

2008-10-16 Thread Phil Vandry
On Thu, 16 Oct 2008 15:34:53 -0400, Michael Richardson wrote: > RFC4288 (http://tools.ietf.org/html/rfc4288) is the latest doctrine on > getting media types, and basically, we post to [EMAIL PROTECTED] > As for a specification document, pcap.h is basically it. > We would be a vendor type. Yo

Re: [tcpdump-workers] MIME type for libpcap-format capture files

2008-10-16 Thread Phil Vandry
On Thu, Oct 16, 2008 at 09:07:17AM -0700, Gerald Combs wrote: > Debian and Ubuntu have the following entry in /etc/mime.types: > > application/cap cap pcap It's a start but I don't agree with the choice of type. First they ignored the specification which clearly sa

[tcpdump-workers] MIME type for libpcap-format capture files

2008-10-16 Thread Phil Vandry
Hello tcpdump-workers, I noticed that there does not seem to be any MIME type defined for libpcap-format packet capture files according to the list of types maintained by IANA: http://www.iana.org/assignments/media-types/ I couldn't find any well-known but unofficial MIME type either. It seems t