[Guy Harris <guy@xxxxxxxxxxxx>]

On Oct 29, 2003, at 10:56 AM, Richard Sharpe wrote:

> Should we develop an RFC?

If by "RFC" you mean an Internet RFC, we should probably consider doing 
that for libpcap-ng format; there's already one for snoop format 
(although it's incomplete, as it doesn't describe atmsnoop format).

If you just mean a proposed format for developers of various packet 
analysis programs (tcpdump, Ethereal, snort, Kismet, etc.) to review, 
yes, we should do that, although the developers of those programs 
interested in libpcap-ng should probably be part of the group designing 
the format.  (I have some mail from a while ago discussing this with 
some people, including, I think, Mike Kershaw of Kismet fame; I'll dig 
it up.)