PCAP file format specification is a draft from 2004??

Aug 12, 2013 at 2:32 PM
Edited Aug 12, 2013 at 2:34 PM
The PCAP file format is specified at winpcap.org, ntar, just follow the format button. The specification starts with a paragraph on drafts, how to use use it, not referencing to it in other ways as 'work in progress' and specifies an expire date.

The PCAPNG specification is a draft dated with an expire date of september second, 2004.

And this is still the 'current' version of the file format??
Aug 16, 2013 at 8:41 AM
Hi PapaAtHome,

As far as I understand, yes.
It is probably better to ask this someone at WinPcap, but I would imagine that we still use the expired version.
You can see it was updated quite a bit after 2004.
I'm sure that there are a lot of file formats that don't have a specification at all at IETF, why doesn't this bother you?

Aug 17, 2013 at 2:00 PM
Hi Brickner,

Yes, I did see it. Still it looks very silly to me to specify a procedure in great detail and then not following it.
But this is the wrong place to bitch about it.

Thanks for the reply and your time.

Kind regards,
André Steenveld.