On Apr 26, 2012, at 11:06 AM, Bill Meier wrote:
> Can pcapng files also be given a mime-type of application/vnd.tcpdump.pcap ?
In theory, although there should really be a new application/vnd.tcpdump.pcapng type or something such as that, as the application/vnd.tcpdump.pcap definition:
http://www.iana.org/assignments/media-types/application/vnd.tcpdump.pcap
explicitly speaks only of pcap. At least as I read section 4.4 "Canonicalization and Format Requirements" of RFC 2488
http://tools.ietf.org/html/rfc4288#section-4.4
"All registered media types MUST employ a single, canonical data format, regardless of registration tree.
A precise and openly available specification of the format of each media type MUST exist for all types registered in the standards tree and MUST at a minimum be referenced by, if it isn't actually included in, the media type registration proposal itself."
pcap-ng should have a separate media type, as it's a different data format from pcap.
In practice, people will probably be using the same programs to read both file types (any program that reads only one such file format should either be upgraded to handle both or just use libpcap so that with libpcap 1.1.0 or later it can read pcap-ng files to some degree), so it might not make a difference.
For now, my inclination would be to use application/octet-stream. We could, I guess, use an x. type for now:
http://tools.ietf.org/html/rfc4288#section-3.4
with a registered type for pcap-ng coming later.