Sorry to answer this late; I saw this email a week ago but didn't
manage to reply - the todo got swapped out but never swapped in again.
Graham gave me a heads up (that I didn't see until now, either,
*sigh*), so here I go.
>> Q2: What is the status of pcap-ng?
>>
>> * "it works fine, everyone's using it, it just isn't an RFC"
>> or * "it's an abandoned effort, plain pcap is good enough"
>> or * "all development has moved to X, take a look at X"
> "It works fine, some software's using it, and there's no RFC for
> pcap format, either, although there probably should be informative
> RFCs for both of them at some point."
At Sharkfest 2013 we (me, plus the Wireshark devs that were "in
range") had a impromptu meeting regarding the status of the PCAP-ng
specifications.
I offered to see if we can go in the direction of an RFC, but got a
bit sidetracked. I had checked how the procedures work in July/August, but
at the time the RFC submission process was closed for new submissions.
It should be open again by now, so I'll try to go forward asap.
Oh, and regarding the status of PCAP-ng I'd say it is more like "a
couple of tools are using it, but most are still stuck on pcap for
whatever reason."
Cheers,
Jasper