Wireshark · Ethereal-dev: Re: [Ethereal-dev] Any "standard" file extension for gzipped pcap files?

[Ulf Lamping <ulf.lamping@xxxxxx>]

Guy Harris wrote:
> That's what I use, too, but I'm not sure Windows supports the notion 
> of registering a file name extension containing a "." - or, 
> alternatively, registering a pair of extensions.
>
> (For that matter, I'm not sure whether other desktop environments, 
> such as OS X, KDE, or GNOME, support it either - or whether KDE or 
> GNOME, which can match on file *contents* as well as file 
> *extensions*, would see a gzipped file and look at the beginning of 
> the ungzipped contents, or, if they did, whether an application could 
> register as one that can handle a gzipped file.)
I've modified the NSIS installer to register .pcap.gz as you've 
mentioned. Just as before, when I click on such a file in the Windows 
Explorer, WinZip opens up, so this just don't work well :-(

When looking into the Explorer / Tools / Folder Options / File Types I 
can see the extension PCAP.GZ, so it seems at least to be registered ok. 
When looking at all the other extensions, there's no other extension 
with a "." in it, so it's probably not working that way.

After thinking of it again, it was a .caz extension I've seen somewhere 
before. Referring to http://filext.com this is a "Computer Associates 
Archive" file.

So in the end I would suggest to use .pcaz as the gzipped compressed 
libpcap file extension. It seems to be unused referring to 
http://filext.com and should be working on all platforms Ethereal 
supports (incl. Win32).

Having a file extension to indicate if the file is already compressed 
seems to be a good idea to me ...

Regards, ULFL