| Internet-Draft | pcaplinktype | August 2024 |
| Harris & Richardson | Expires 17 February 2025 | [Page] |
This document creates an IANA registry for the PCAP and PCAPNG LINKTYPE values. The PCAP and PCAPNG formats are used to save network captures from programs such as tcpdump and wireshark, when using libraries such as libpcap.¶
This note is to be removed before publishing as an RFC.¶
Status information for this document may be found at https://datatracker.ietf.org/doc/draft-ietf-opsawg-pcaplinktype/.¶
Discussion of this document takes place on the opsawg Working Group mailing list (mailto:opsawg@ietf.org), which is archived at https://mailarchive.ietf.org/arch/browse/opsawg/. Subscribe at https://www.ietf.org/mailman/listinfo/opsawg/.¶
Source for this draft and an issue tracker can be found at https://github.com/IETF-OPSAWG-WG/pcapng.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 17 February 2025.¶
Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
In the late 1980's, Van Jacobson, Steve McCanne, and others at the Network Research Group at Lawrence Berkeley National Laboratory developed the tcpdump program to capture and dissect network traces. The code to capture traffic, using low-level mechanisms in various operating systems, and to read and write network traces to a file was later put into a library named libpcap [LIBPCAP].¶
Other documents describe the original (legacy) format used by tcpdump (pcap), as well as the revised format (pcapng) which is used by tcpdump and Wireshark [Wireshark].¶
Within those formats each packet that is captured is described by a LINKTYPE value. The LINKTYPE value selects one of many hundred formats for metadata and Layer 2 encapsulation of the packet.¶
This document creates an IANA registry for the LINKTYPE format, establishing the IANA Considerations by which other uses of the pcap and pcapng formats may register new LINKTYPE values.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶
IANA is requested to create a new registry group entitled "The PCAP Registry".¶
IANA is also requested to create a registry entitled "PCAP LinkType List" under The PCAP registry group (Section 3.1).¶
The registry has the following structure:¶
The LinkType value is a 16-bit number. The policy allocation for the LinkType values is as follows:¶
The initial version of the registry is provided in Section 3.2.1. In each case here, the reference should be to [TCPDUMP] and the RFC number to be assigned to this document, which is not repeated each time.¶
The initial values table is based upon the Link type list maintained by libpcap, and published on [TCPDUMP].¶
Note that historically, values were assigned incrementally following First Come First Served policy, with a preference for a public specification, but with no mandate. Some historical values may have less specification than desired.¶
LinkType values 147 to 162 named LINKTYPE_RESERVED_xx were originally reserved for Private Use. Their use is Deprecated in favour of the values in the 65001-65535 range.¶
In general, Private Use values should never leak out of the entity that uses it. As the First Come First Served range is large and easily obtained, official values are recommended.¶
There is often an associated DLT value which is often identical in value, but not universally so. DLT values are associated with specific operation system captures, and are operating system specific, and are thus not subject to standardization.¶
Option A: Initial Values of "PCAP LinkType List" Registry¶
----------------------------------------------¶
Option B: Initial Values of "PCAP LinkType List" Registry¶
| Value |
|
Reference |
|---|---|---|
| 0 |
|
[LINKTYPE_NULL] |
| 1 |
|
|
| 189 |
|
|
| 237 |
|
[STANAG-5066] |