[Guy Harris <guy@xxxxxxxxxx>]

> At the moment we have a very basic version for win32 that we
> have tested with windump and Analyzer.  In the future we plan to add
> features like autentication, cryptography, data compression and remote
> statistical analysis and then release the code in the winpcap source
> distribution.  Has anyone comments or suggestion on this approach?

It sounds reasonable (at least once there's authentication); you should
probably send the client code (the "pcap-xxx.c" file) to tcpdump.org for
inclusion in standard libpcap.

Does the server use libpcap for capturing?  If so, sending server code
to tcpdump.org would probably be a good idea as well, so that a UNIX
port can be distributed by tcpdump.org.

Should an RFC be written for the protocol?  (Some protocol spec should
probably be written up.)  I don't know what the process is for getting
an RFC published - I don't know if it'd first be done as an
Internet-Draft, or not.

You might also want to mention this on tcpdump-workers.