]> The Tcpdump Group git mirrors - libpcap/blob - pcap-common.c
projects / libpcap / blob
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
EOPNOTSUPP from an ethtool ioctl should not be a fatal error.
[libpcap] / pcap-common.c
1 /*
2 * Copyright (c) 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 * pcap-common.c - common code for pcap and pcap-ng files
22 */
23
24 #ifdef HAVE_CONFIG_H
25 #include "config.h"
26 #endif
27
28 #ifdef WIN32
29 #include <pcap-stdinc.h>
30 #else /* WIN32 */
31 #if HAVE_INTTYPES_H
32 #include <inttypes.h>
33 #elif HAVE_STDINT_H
34 #include <stdint.h>
35 #endif
36 #ifdef HAVE_SYS_BITYPES_H
37 #include <sys/bitypes.h>
38 #endif
39 #include <sys/types.h>
40 #endif /* WIN32 */
41
42 #include "pcap-int.h"
43 #include "pcap/usb.h"
44
45 #include "pcap-common.h"
46
47 /*
48 * We don't write DLT_* values to capture files, because they're not the
49 * same on all platforms.
50 *
51 * Unfortunately, the various flavors of BSD have not always used the same
52 * numerical values for the same data types, and various patches to
53 * libpcap for non-BSD OSes have added their own DLT_* codes for link
54 * layer encapsulation types seen on those OSes, and those codes have had,
55 * in some cases, values that were also used, on other platforms, for other
56 * link layer encapsulation types.
57 *
58 * This means that capture files of a type whose numerical DLT_* code
59 * means different things on different BSDs, or with different versions
60 * of libpcap, can't always be read on systems other than those like
61 * the one running on the machine on which the capture was made.
62 *
63 * Instead, we define here a set of LINKTYPE_* codes, and map DLT_* codes
64 * to LINKTYPE_* codes when writing a savefile header, and map LINKTYPE_*
65 * codes to DLT_* codes when reading a savefile header.
66 *
67 * For those DLT_* codes that have, as far as we know, the same values on
68 * all platforms (DLT_NULL through DLT_FDDI), we define LINKTYPE_xxx as
69 * DLT_xxx; that way, captures of those types can still be read by
70 * versions of libpcap that map LINKTYPE_* values to DLT_* values, and
71 * captures of those types written by versions of libpcap that map DLT_
72 * values to LINKTYPE_ values can still be read by older versions
73 * of libpcap.
74 *
75 * The other LINKTYPE_* codes are given values starting at 100, in the
76 * hopes that no DLT_* code will be given one of those values.
77 *
78 * In order to ensure that a given LINKTYPE_* code's value will refer to
79 * the same encapsulation type on all platforms, you should not allocate
80 * a new LINKTYPE_* value without consulting
81 * "tcpdump-workers@lists.tcpdump.org". The tcpdump developers will
82 * allocate a value for you, and will not subsequently allocate it to
83 * anybody else; that value will be added to the "pcap.h" in the
84 * tcpdump.org Git repository, so that a future libpcap release will
85 * include it.
86 *
87 * You should, if possible, also contribute patches to libpcap and tcpdump
88 * to handle the new encapsulation type, so that they can also be checked
89 * into the tcpdump.org Git repository and so that they will appear in
90 * future libpcap and tcpdump releases.
91 *
92 * Do *NOT* assume that any values after the largest value in this file
93 * are available; you might not have the most up-to-date version of this
94 * file, and new values after that one might have been assigned. Also,
95 * do *NOT* use any values below 100 - those might already have been
96 * taken by one (or more!) organizations.
97 */
98 #define LINKTYPE_NULL DLT_NULL
99 #define LINKTYPE_ETHERNET DLT_EN10MB /* also for 100Mb and up */
100 #define LINKTYPE_EXP_ETHERNET DLT_EN3MB /* 3Mb experimental Ethernet */
101 #define LINKTYPE_AX25 DLT_AX25
102 #define LINKTYPE_PRONET DLT_PRONET
103 #define LINKTYPE_CHAOS DLT_CHAOS
104 #define LINKTYPE_TOKEN_RING DLT_IEEE802 /* DLT_IEEE802 is used for Token Ring */
105 #define LINKTYPE_ARCNET_BSD DLT_ARCNET /* BSD-style headers */
106 #define LINKTYPE_SLIP DLT_SLIP
107 #define LINKTYPE_PPP DLT_PPP
108 #define LINKTYPE_FDDI DLT_FDDI
109
110 /*
111 * LINKTYPE_PPP is for use when there might, or might not, be an RFC 1662
112 * PPP in HDLC-like framing header (with 0xff 0x03 before the PPP protocol
113 * field) at the beginning of the packet.
114 *
115 * This is for use when there is always such a header; the address field
116 * might be 0xff, for regular PPP, or it might be an address field for Cisco
117 * point-to-point with HDLC framing as per section 4.3.1 of RFC 1547 ("Cisco
118 * HDLC"). This is, for example, what you get with NetBSD's DLT_PPP_SERIAL.
119 *
120 * We give it the same value as NetBSD's DLT_PPP_SERIAL, in the hopes that
121 * nobody else will choose a DLT_ value of 50, and so that DLT_PPP_SERIAL
122 * captures will be written out with a link type that NetBSD's tcpdump
123 * can read.
124 */
125 #define LINKTYPE_PPP_HDLC 50 /* PPP in HDLC-like framing */
126
127 #define LINKTYPE_PPP_ETHER 51 /* NetBSD PPP-over-Ethernet */
128
129 #define LINKTYPE_SYMANTEC_FIREWALL 99 /* Symantec Enterprise Firewall */
130
131 #define LINKTYPE_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */
132 #define LINKTYPE_RAW 101 /* raw IP */
133 #define LINKTYPE_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */
134 #define LINKTYPE_PPP_BSDOS 103 /* BSD/OS PPP BPF header */
135 #define LINKTYPE_C_HDLC 104 /* Cisco HDLC */
136 #define LINKTYPE_IEEE802_11 105 /* IEEE 802.11 (wireless) */
137 #define LINKTYPE_ATM_CLIP 106 /* Linux Classical IP over ATM */
138 #define LINKTYPE_FRELAY 107 /* Frame Relay */
139 #define LINKTYPE_LOOP 108 /* OpenBSD loopback */
140 #define LINKTYPE_ENC 109 /* OpenBSD IPSEC enc */
141
142 /*
143 * These three types are reserved for future use.
144 */
145 #define LINKTYPE_LANE8023 110 /* ATM LANE + 802.3 */
146 #define LINKTYPE_HIPPI 111 /* NetBSD HIPPI */
147 #define LINKTYPE_HDLC 112 /* NetBSD HDLC framing */
148
149 #define LINKTYPE_LINUX_SLL 113 /* Linux cooked socket capture */
150 #define LINKTYPE_LTALK 114 /* Apple LocalTalk hardware */
151 #define LINKTYPE_ECONET 115 /* Acorn Econet */
152
153 /*
154 * Reserved for use with OpenBSD ipfilter.
155 */
156 #define LINKTYPE_IPFILTER 116
157
158 #define LINKTYPE_PFLOG 117 /* OpenBSD DLT_PFLOG */
159 #define LINKTYPE_CISCO_IOS 118 /* For Cisco-internal use */
160 #define LINKTYPE_PRISM_HEADER 119 /* 802.11+Prism II monitor mode */
161 #define LINKTYPE_AIRONET_HEADER 120 /* FreeBSD Aironet driver stuff */
162
163 /*
164 * Reserved for Siemens HiPath HDLC.
165 */
166 #define LINKTYPE_HHDLC 121
167
168 #define LINKTYPE_IP_OVER_FC 122 /* RFC 2625 IP-over-Fibre Channel */
169 #define LINKTYPE_SUNATM 123 /* Solaris+SunATM */
170
171 /*
172 * Reserved as per request from Kent Dahlgren <kent@praesum.com>
173 * for private use.
174 */
175 #define LINKTYPE_RIO 124 /* RapidIO */
176 #define LINKTYPE_PCI_EXP 125 /* PCI Express */
177 #define LINKTYPE_AURORA 126 /* Xilinx Aurora link layer */
178
179 #define LINKTYPE_IEEE802_11_RADIO 127 /* 802.11 plus BSD radio header */
180
181 /*
182 * Reserved for the TZSP encapsulation, as per request from
183 * Chris Waters <chris.waters@networkchemistry.com>
184 * TZSP is a generic encapsulation for any other link type,
185 * which includes a means to include meta-information
186 * with the packet, e.g. signal strength and channel
187 * for 802.11 packets.
188 */
189 #define LINKTYPE_TZSP 128 /* Tazmen Sniffer Protocol */
190
191 #define LINKTYPE_ARCNET_LINUX 129 /* Linux-style headers */
192
193 /*
194 * Juniper-private data link types, as per request from
195 * Hannes Gredler <hannes@juniper.net>. The corresponding
196 * DLT_s are used for passing on chassis-internal
197 * metainformation such as QOS profiles, etc..
198 */
199 #define LINKTYPE_JUNIPER_MLPPP 130
200 #define LINKTYPE_JUNIPER_MLFR 131
201 #define LINKTYPE_JUNIPER_ES 132
202 #define LINKTYPE_JUNIPER_GGSN 133
203 #define LINKTYPE_JUNIPER_MFR 134
204 #define LINKTYPE_JUNIPER_ATM2 135
205 #define LINKTYPE_JUNIPER_SERVICES 136
206 #define LINKTYPE_JUNIPER_ATM1 137
207
208 #define LINKTYPE_APPLE_IP_OVER_IEEE1394 138 /* Apple IP-over-IEEE 1394 cooked header */
209
210 #define LINKTYPE_MTP2_WITH_PHDR 139
211 #define LINKTYPE_MTP2 140
212 #define LINKTYPE_MTP3 141
213 #define LINKTYPE_SCCP 142
214
215 #define LINKTYPE_DOCSIS 143 /* DOCSIS MAC frames */
216
217 #define LINKTYPE_LINUX_IRDA 144 /* Linux-IrDA */
218
219 /*
220 * Reserved for IBM SP switch and IBM Next Federation switch.
221 */
222 #define LINKTYPE_IBM_SP 145
223 #define LINKTYPE_IBM_SN 146
224
225 /*
226 * Reserved for private use. If you have some link-layer header type
227 * that you want to use within your organization, with the capture files
228 * using that link-layer header type not ever be sent outside your
229 * organization, you can use these values.
230 *
231 * No libpcap release will use these for any purpose, nor will any
232 * tcpdump release use them, either.
233 *
234 * Do *NOT* use these in capture files that you expect anybody not using
235 * your private versions of capture-file-reading tools to read; in
236 * particular, do *NOT* use them in products, otherwise you may find that
237 * people won't be able to use tcpdump, or snort, or Ethereal, or... to
238 * read capture files from your firewall/intrusion detection/traffic
239 * monitoring/etc. appliance, or whatever product uses that LINKTYPE_ value,
240 * and you may also find that the developers of those applications will
241 * not accept patches to let them read those files.
242 *
243 * Also, do not use them if somebody might send you a capture using them
244 * for *their* private type and tools using them for *your* private type
245 * would have to read them.
246 *
247 * Instead, in those cases, ask "tcpdump-workers@lists.tcpdump.org" for a
248 * new DLT_ and LINKTYPE_ value, as per the comment in pcap/bpf.h, and use
249 * the type you're given.
250 */
251 #define LINKTYPE_USER0 147
252 #define LINKTYPE_USER1 148
253 #define LINKTYPE_USER2 149
254 #define LINKTYPE_USER3 150
255 #define LINKTYPE_USER4 151
256 #define LINKTYPE_USER5 152
257 #define LINKTYPE_USER6 153
258 #define LINKTYPE_USER7 154
259 #define LINKTYPE_USER8 155
260 #define LINKTYPE_USER9 156
261 #define LINKTYPE_USER10 157
262 #define LINKTYPE_USER11 158
263 #define LINKTYPE_USER12 159
264 #define LINKTYPE_USER13 160
265 #define LINKTYPE_USER14 161
266 #define LINKTYPE_USER15 162
267
268 /*
269 * For future use with 802.11 captures - defined by AbsoluteValue
270 * Systems to store a number of bits of link-layer information
271 * including radio information:
272 *
273 * http://www.shaftnet.org/~pizza/software/capturefrm.txt
274 *
275 * but could and arguably should also be used by non-AVS Linux
276 * 802.11 drivers; that may happen in the future.
277 */
278 #define LINKTYPE_IEEE802_11_RADIO_AVS 163 /* 802.11 plus AVS radio header */
279
280 /*
281 * Juniper-private data link type, as per request from
282 * Hannes Gredler <hannes@juniper.net>. The corresponding
283 * DLT_s are used for passing on chassis-internal
284 * metainformation such as QOS profiles, etc..
285 */
286 #define LINKTYPE_JUNIPER_MONITOR 164
287
288 /*
289 * Reserved for BACnet MS/TP.
290 */
291 #define LINKTYPE_BACNET_MS_TP 165
292
293 /*
294 * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>.
295 *
296 * This is used in some OSes to allow a kernel socket filter to distinguish
297 * between incoming and outgoing packets, on a socket intended to
298 * supply pppd with outgoing packets so it can do dial-on-demand and
299 * hangup-on-lack-of-demand; incoming packets are filtered out so they
300 * don't cause pppd to hold the connection up (you don't want random
301 * input packets such as port scans, packets from old lost connections,
302 * etc. to force the connection to stay up).
303 *
304 * The first byte of the PPP header (0xff03) is modified to accomodate
305 * the direction - 0x00 = IN, 0x01 = OUT.
306 */
307 #define LINKTYPE_PPP_PPPD 166
308
309 /*
310 * Juniper-private data link type, as per request from
311 * Hannes Gredler <hannes@juniper.net>. The DLT_s are used
312 * for passing on chassis-internal metainformation such as
313 * QOS profiles, cookies, etc..
314 */
315 #define LINKTYPE_JUNIPER_PPPOE 167
316 #define LINKTYPE_JUNIPER_PPPOE_ATM 168
317
318 #define LINKTYPE_GPRS_LLC 169 /* GPRS LLC */
319 #define LINKTYPE_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */
320 #define LINKTYPE_GPF_F 171 /* GPF-T (ITU-T G.7041/Y.1303) */
321
322 /*
323 * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line
324 * monitoring equipment.
325 */
326 #define LINKTYPE_GCOM_T1E1 172
327 #define LINKTYPE_GCOM_SERIAL 173
328
329 /*
330 * Juniper-private data link type, as per request from
331 * Hannes Gredler <hannes@juniper.net>. The DLT_ is used
332 * for internal communication to Physical Interface Cards (PIC)
333 */
334 #define LINKTYPE_JUNIPER_PIC_PEER 174
335
336 /*
337 * Link types requested by Gregor Maier <gregor@endace.com> of Endace
338 * Measurement Systems. They add an ERF header (see
339 * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of
340 * the link-layer header.
341 */
342 #define LINKTYPE_ERF_ETH 175 /* Ethernet */
343 #define LINKTYPE_ERF_POS 176 /* Packet-over-SONET */
344
345 /*
346 * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD
347 * for vISDN (http://www.orlandi.com/visdn/). Its link-layer header
348 * includes additional information before the LAPD header, so it's
349 * not necessarily a generic LAPD header.
350 */
351 #define LINKTYPE_LINUX_LAPD 177
352
353 /*
354 * Juniper-private data link type, as per request from
355 * Hannes Gredler <hannes@juniper.net>.
356 * The Link Types are used for prepending meta-information
357 * like interface index, interface name
358 * before standard Ethernet, PPP, Frelay & C-HDLC Frames
359 */
360 #define LINKTYPE_JUNIPER_ETHER 178
361 #define LINKTYPE_JUNIPER_PPP 179
362 #define LINKTYPE_JUNIPER_FRELAY 180
363 #define LINKTYPE_JUNIPER_CHDLC 181
364
365 /*
366 * Multi Link Frame Relay (FRF.16)
367 */
368 #define LINKTYPE_MFR 182
369
370 /*
371 * Juniper-private data link type, as per request from
372 * Hannes Gredler <hannes@juniper.net>.
373 * The DLT_ is used for internal communication with a
374 * voice Adapter Card (PIC)
375 */
376 #define LINKTYPE_JUNIPER_VP 183
377
378 /*
379 * Arinc 429 frames.
380 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
381 * Every frame contains a 32bit A429 label.
382 * More documentation on Arinc 429 can be found at
383 * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
384 */
385 #define LINKTYPE_A429 184
386
387 /*
388 * Arinc 653 Interpartition Communication messages.
389 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
390 * Please refer to the A653-1 standard for more information.
391 */
392 #define LINKTYPE_A653_ICM 185
393
394 /*
395 * USB packets, beginning with a USB setup header; requested by
396 * Paolo Abeni <paolo.abeni@email.it>.
397 */
398 #define LINKTYPE_USB 186
399
400 /*
401 * Bluetooth HCI UART transport layer (part H:4); requested by
402 * Paolo Abeni.
403 */
404 #define LINKTYPE_BLUETOOTH_HCI_H4 187
405
406 /*
407 * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
408 * <cruz_petagay@bah.com>.
409 */
410 #define LINKTYPE_IEEE802_16_MAC_CPS 188
411
412 /*
413 * USB packets, beginning with a Linux USB header; requested by
414 * Paolo Abeni <paolo.abeni@email.it>.
415 */
416 #define LINKTYPE_USB_LINUX 189
417
418 /*
419 * Controller Area Network (CAN) v. 2.0B packets.
420 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
421 * Used to dump CAN packets coming from a CAN Vector board.
422 * More documentation on the CAN v2.0B frames can be found at
423 * http://www.can-cia.org/downloads/?269
424 */
425 #define LINKTYPE_CAN20B 190
426
427 /*
428 * IEEE 802.15.4, with address fields padded, as is done by Linux
429 * drivers; requested by Juergen Schimmer.
430 */
431 #define LINKTYPE_IEEE802_15_4_LINUX 191
432
433 /*
434 * Per Packet Information encapsulated packets.
435 * LINKTYPE_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
436 */
437 #define LINKTYPE_PPI 192
438
439 /*
440 * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
441 * requested by Charles Clancy.
442 */
443 #define LINKTYPE_IEEE802_16_MAC_CPS_RADIO 193
444
445 /*
446 * Juniper-private data link type, as per request from
447 * Hannes Gredler <hannes@juniper.net>.
448 * The DLT_ is used for internal communication with a
449 * integrated service module (ISM).
450 */
451 #define LINKTYPE_JUNIPER_ISM 194
452
453 /*
454 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
455 * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.
456 */
457 #define LINKTYPE_IEEE802_15_4 195
458
459 /*
460 * Various link-layer types, with a pseudo-header, for SITA
461 * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).
462 */
463 #define LINKTYPE_SITA 196
464
465 /*
466 * Various link-layer types, with a pseudo-header, for Endace DAG cards;
467 * encapsulates Endace ERF records. Requested by Stephen Donnelly
468 * <stephen@endace.com>.
469 */
470 #define LINKTYPE_ERF 197
471
472 /*
473 * Special header prepended to Ethernet packets when capturing from a
474 * u10 Networks board. Requested by Phil Mulholland
475 * <phil@u10networks.com>.
476 */
477 #define LINKTYPE_RAIF1 198
478
479 /*
480 * IPMB packet for IPMI, beginning with the I2C slave address, followed
481 * by the netFn and LUN, etc.. Requested by Chanthy Toeung
482 * <chanthy.toeung@ca.kontron.com>.
483 */
484 #define LINKTYPE_IPMB 199
485
486 /*
487 * Juniper-private data link type, as per request from
488 * Hannes Gredler <hannes@juniper.net>.
489 * The DLT_ is used for capturing data on a secure tunnel interface.
490 */
491 #define LINKTYPE_JUNIPER_ST 200
492
493 /*
494 * Bluetooth HCI UART transport layer (part H:4), with pseudo-header
495 * that includes direction information; requested by Paolo Abeni.
496 */
497 #define LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR 201
498
499 /*
500 * AX.25 packet with a 1-byte KISS header; see
501 *
502 * http://www.ax25.net/kiss.htm
503 *
504 * as per Richard Stearn <richard@rns-stearn.demon.co.uk>.
505 */
506 #define LINKTYPE_AX25_KISS 202
507
508 /*
509 * LAPD packets from an ISDN channel, starting with the address field,
510 * with no pseudo-header.
511 * Requested by Varuna De Silva <varunax@gmail.com>.
512 */
513 #define LINKTYPE_LAPD 203
514
515 /*
516 * Variants of various link-layer headers, with a one-byte direction
517 * pseudo-header prepended - zero means "received by this host",
518 * non-zero (any non-zero value) means "sent by this host" - as per
519 * Will Barker <w.barker@zen.co.uk>.
520 */
521 #define LINKTYPE_PPP_WITH_DIR 204 /* PPP */
522 #define LINKTYPE_C_HDLC_WITH_DIR 205 /* Cisco HDLC */
523 #define LINKTYPE_FRELAY_WITH_DIR 206 /* Frame Relay */
524 #define LINKTYPE_LAPB_WITH_DIR 207 /* LAPB */
525
526 /*
527 * 208 is reserved for an as-yet-unspecified proprietary link-layer
528 * type, as requested by Will Barker.
529 */
530
531 /*
532 * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman
533 * <avn@pigeonpoint.com>.
534 */
535 #define LINKTYPE_IPMB_LINUX 209
536
537 /*
538 * FlexRay automotive bus - http://www.flexray.com/ - as requested
539 * by Hannes Kaelber <hannes.kaelber@x2e.de>.
540 */
541 #define LINKTYPE_FLEXRAY 210
542
543 /*
544 * Media Oriented Systems Transport (MOST) bus for multimedia
545 * transport - http://www.mostcooperation.com/ - as requested
546 * by Hannes Kaelber <hannes.kaelber@x2e.de>.
547 */
548 #define LINKTYPE_MOST 211
549
550 /*
551 * Local Interconnect Network (LIN) bus for vehicle networks -
552 * http://www.lin-subbus.org/ - as requested by Hannes Kaelber
553 * <hannes.kaelber@x2e.de>.
554 */
555 #define LINKTYPE_LIN 212
556
557 /*
558 * X2E-private data link type used for serial line capture,
559 * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
560 */
561 #define LINKTYPE_X2E_SERIAL 213
562
563 /*
564 * X2E-private data link type used for the Xoraya data logger
565 * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
566 */
567 #define LINKTYPE_X2E_XORAYA 214
568
569 /*
570 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
571 * nothing), but with the PHY-level data for non-ASK PHYs (4 octets
572 * of 0 as preamble, one octet of SFD, one octet of frame length+
573 * reserved bit, and then the MAC-layer data, starting with the
574 * frame control field).
575 *
576 * Requested by Max Filippov <jcmvbkbc@gmail.com>.
577 */
578 #define LINKTYPE_IEEE802_15_4_NONASK_PHY 215
579
580 /*
581 * David Gibson <david@gibson.dropbear.id.au> requested this for
582 * captures from the Linux kernel /dev/input/eventN devices. This
583 * is used to communicate keystrokes and mouse movements from the
584 * Linux kernel to display systems, such as Xorg.
585 */
586 #define LINKTYPE_LINUX_EVDEV 216
587
588 /*
589 * GSM Um and Abis interfaces, preceded by a "gsmtap" header.
590 *
591 * Requested by Harald Welte <laforge@gnumonks.org>.
592 */
593 #define LINKTYPE_GSMTAP_UM 217
594 #define LINKTYPE_GSMTAP_ABIS 218
595
596 /*
597 * MPLS, with an MPLS label as the link-layer header.
598 * Requested by Michele Marchetto <michele@openbsd.org> on behalf
599 * of OpenBSD.
600 */
601 #define LINKTYPE_MPLS 219
602
603 /*
604 * USB packets, beginning with a Linux USB header, with the USB header
605 * padded to 64 bytes; required for memory-mapped access.
606 */
607 #define LINKTYPE_USB_LINUX_MMAPPED 220
608
609 /*
610 * DECT packets, with a pseudo-header; requested by
611 * Matthias Wenzel <tcpdump@mazzoo.de>.
612 */
613 #define LINKTYPE_DECT 221
614
615 /*
616 * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov>
617 * Date: Mon, 11 May 2009 11:18:30 -0500
618 *
619 * DLT_AOS. We need it for AOS Space Data Link Protocol.
620 * I have already written dissectors for but need an OK from
621 * legal before I can submit a patch.
622 *
623 */
624 #define LINKTYPE_AOS 222
625
626 /*
627 * Wireless HART (Highway Addressable Remote Transducer)
628 * From the HART Communication Foundation
629 * IES/PAS 62591
630 *
631 * Requested by Sam Roberts <vieuxtech@gmail.com>.
632 */
633 #define LINKTYPE_WIHART 223
634
635 /*
636 * Fibre Channel FC-2 frames, beginning with a Frame_Header.
637 * Requested by Kahou Lei <kahou82@gmail.com>.
638 */
639 #define LINKTYPE_FC_2 224
640
641 /*
642 * Fibre Channel FC-2 frames, beginning with an encoding of the
643 * SOF, and ending with an encoding of the EOF.
644 *
645 * The encodings represent the frame delimiters as 4-byte sequences
646 * representing the corresponding ordered sets, with K28.5
647 * represented as 0xBC, and the D symbols as the corresponding
648 * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2,
649 * is represented as 0xBC 0xB5 0x55 0x55.
650 *
651 * Requested by Kahou Lei <kahou82@gmail.com>.
652 */
653 #define LINKTYPE_FC_2_WITH_FRAME_DELIMS 225
654
655 /*
656 * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>.
657 *
658 * The pseudo-header starts with a one-byte version number; for version 2,
659 * the pseudo-header is:
660 *
661 * struct dl_ipnetinfo {
662 * u_int8_t dli_version;
663 * u_int8_t dli_family;
664 * u_int16_t dli_htype;
665 * u_int32_t dli_pktlen;
666 * u_int32_t dli_ifindex;
667 * u_int32_t dli_grifindex;
668 * u_int32_t dli_zsrc;
669 * u_int32_t dli_zdst;
670 * };
671 *
672 * dli_version is 2 for the current version of the pseudo-header.
673 *
674 * dli_family is a Solaris address family value, so it's 2 for IPv4
675 * and 26 for IPv6.
676 *
677 * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing
678 * packets, and 2 for packets arriving from another zone on the same
679 * machine.
680 *
681 * dli_pktlen is the length of the packet data following the pseudo-header
682 * (so the captured length minus dli_pktlen is the length of the
683 * pseudo-header, assuming the entire pseudo-header was captured).
684 *
685 * dli_ifindex is the interface index of the interface on which the
686 * packet arrived.
687 *
688 * dli_grifindex is the group interface index number (for IPMP interfaces).
689 *
690 * dli_zsrc is the zone identifier for the source of the packet.
691 *
692 * dli_zdst is the zone identifier for the destination of the packet.
693 *
694 * A zone number of 0 is the global zone; a zone number of 0xffffffff
695 * means that the packet arrived from another host on the network, not
696 * from another zone on the same machine.
697 *
698 * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates
699 * which of those it is.
700 */
701 #define LINKTYPE_IPNET 226
702
703 /*
704 * CAN (Controller Area Network) frames, with a pseudo-header as supplied
705 * by Linux SocketCAN. See Documentation/networking/can.txt in the Linux
706 * source.
707 *
708 * Requested by Felix Obenhuber <felix@obenhuber.de>.
709 */
710 #define LINKTYPE_CAN_SOCKETCAN 227
711
712 /*
713 * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies
714 * whether it's v4 or v6. Requested by Darren Reed <Darren.Reed@Sun.COM>.
715 */
716 #define LINKTYPE_IPV4 228
717 #define LINKTYPE_IPV6 229
718
719 /*
720 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
721 * nothing), and with no FCS at the end of the frame; requested by
722 * Jon Smirl <jonsmirl@gmail.com>.
723 */
724 #define LINKTYPE_IEEE802_15_4_NOFCS 230
725
726 /*
727 * Raw D-Bus:
728 *
729 * http://www.freedesktop.org/wiki/Software/dbus
730 *
731 * messages:
732 *
733 * http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages
734 *
735 * starting with the endianness flag, followed by the message type, etc.,
736 * but without the authentication handshake before the message sequence:
737 *
738 * http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol
739 *
740 * Requested by Martin Vidner <martin@vidner.net>.
741 */
742 #define LINKTYPE_DBUS 231
743
744 /*
745 * Juniper-private data link type, as per request from
746 * Hannes Gredler <hannes@juniper.net>.
747 */
748 #define LINKTYPE_JUNIPER_VS 232
749 #define LINKTYPE_JUNIPER_SRX_E2E 233
750 #define LINKTYPE_JUNIPER_FIBRECHANNEL 234
751
752 /*
753 * DVB-CI (DVB Common Interface for communication between a PC Card
754 * module and a DVB receiver). See
755 *
756 * http://www.kaiser.cx/pcap-dvbci.html
757 *
758 * for the specification.
759 *
760 * Requested by Martin Kaiser <martin@kaiser.cx>.
761 */
762 #define LINKTYPE_DVB_CI 235
763
764 /*
765 * Variant of 3GPP TS 27.010 multiplexing protocol. Requested
766 * by Hans-Christoph Schemmel <hans-christoph.schemmel@cinterion.com>.
767 */
768 #define LINKTYPE_MUX27010 236
769
770 /*
771 * STANAG 5066 D_PDUs. Requested by M. Baris Demiray
772 * <barisdemiray@gmail.com>.
773 */
774 #define LINKTYPE_STANAG_5066_D_PDU 237
775
776 /*
777 * Juniper-private data link type, as per request from
778 * Hannes Gredler <hannes@juniper.net>.
779 */
780 #define LINKTYPE_JUNIPER_ATM_CEMIC 238
781
782 static struct linktype_map {
783 int dlt;
784 int linktype;
785 } map[] = {
786 /*
787 * These DLT_* codes have LINKTYPE_* codes with values identical
788 * to the values of the corresponding DLT_* code.
789 */
790 { DLT_NULL, LINKTYPE_NULL },
791 { DLT_EN10MB, LINKTYPE_ETHERNET },
792 { DLT_EN3MB, LINKTYPE_EXP_ETHERNET },
793 { DLT_AX25, LINKTYPE_AX25 },
794 { DLT_PRONET, LINKTYPE_PRONET },
795 { DLT_CHAOS, LINKTYPE_CHAOS },
796 { DLT_IEEE802, LINKTYPE_TOKEN_RING },
797 { DLT_ARCNET, LINKTYPE_ARCNET_BSD },
798 { DLT_SLIP, LINKTYPE_SLIP },
799 { DLT_PPP, LINKTYPE_PPP },
800 { DLT_FDDI, LINKTYPE_FDDI },
801
802 /*
803 * These DLT_* codes have different values on different
804 * platforms; we map them to LINKTYPE_* codes that
805 * have values that should never be equal to any DLT_*
806 * code.
807 */
808 #ifdef DLT_FR
809 /* BSD/OS Frame Relay */
810 { DLT_FR, LINKTYPE_FRELAY },
811 #endif
812
813 { DLT_SYMANTEC_FIREWALL, LINKTYPE_SYMANTEC_FIREWALL },
814 { DLT_ATM_RFC1483, LINKTYPE_ATM_RFC1483 },
815 { DLT_RAW, LINKTYPE_RAW },
816 { DLT_SLIP_BSDOS, LINKTYPE_SLIP_BSDOS },
817 { DLT_PPP_BSDOS, LINKTYPE_PPP_BSDOS },
818
819 /* BSD/OS Cisco HDLC */
820 { DLT_C_HDLC, LINKTYPE_C_HDLC },
821
822 /*
823 * These DLT_* codes are not on all platforms, but, so far,
824 * there don't appear to be any platforms that define
825 * other codes with those values; we map them to
826 * different LINKTYPE_* values anyway, just in case.
827 */
828
829 /* Linux ATM Classical IP */
830 { DLT_ATM_CLIP, LINKTYPE_ATM_CLIP },
831
832 /* NetBSD sync/async serial PPP (or Cisco HDLC) */
833 { DLT_PPP_SERIAL, LINKTYPE_PPP_HDLC },
834
835 /* NetBSD PPP over Ethernet */
836 { DLT_PPP_ETHER, LINKTYPE_PPP_ETHER },
837
838 /* IEEE 802.11 wireless */
839 { DLT_IEEE802_11, LINKTYPE_IEEE802_11 },
840
841 /* Frame Relay */
842 { DLT_FRELAY, LINKTYPE_FRELAY },
843
844 /* OpenBSD loopback */
845 { DLT_LOOP, LINKTYPE_LOOP },
846
847 /* OpenBSD IPSEC enc */
848 { DLT_ENC, LINKTYPE_ENC },
849
850 /* Linux cooked socket capture */
851 { DLT_LINUX_SLL, LINKTYPE_LINUX_SLL },
852
853 /* Apple LocalTalk hardware */
854 { DLT_LTALK, LINKTYPE_LTALK },
855
856 /* Acorn Econet */
857 { DLT_ECONET, LINKTYPE_ECONET },
858
859 /* OpenBSD DLT_PFLOG */
860 { DLT_PFLOG, LINKTYPE_PFLOG },
861
862 /* For Cisco-internal use */
863 { DLT_CISCO_IOS, LINKTYPE_CISCO_IOS },
864
865 /* Prism II monitor-mode header plus 802.11 header */
866 { DLT_PRISM_HEADER, LINKTYPE_PRISM_HEADER },
867
868 /* FreeBSD Aironet driver stuff */
869 { DLT_AIRONET_HEADER, LINKTYPE_AIRONET_HEADER },
870
871 /* Siemens HiPath HDLC */
872 { DLT_HHDLC, LINKTYPE_HHDLC },
873
874 /* RFC 2625 IP-over-Fibre Channel */
875 { DLT_IP_OVER_FC, LINKTYPE_IP_OVER_FC },
876
877 /* Solaris+SunATM */
878 { DLT_SUNATM, LINKTYPE_SUNATM },
879
880 /* RapidIO */
881 { DLT_RIO, LINKTYPE_RIO },
882
883 /* PCI Express */
884 { DLT_PCI_EXP, LINKTYPE_PCI_EXP },
885
886 /* Xilinx Aurora link layer */
887 { DLT_AURORA, LINKTYPE_AURORA },
888
889 /* 802.11 plus BSD radio header */
890 { DLT_IEEE802_11_RADIO, LINKTYPE_IEEE802_11_RADIO },
891
892 /* Tazmen Sniffer Protocol */
893 { DLT_TZSP, LINKTYPE_TZSP },
894
895 /* Arcnet with Linux-style link-layer headers */
896 { DLT_ARCNET_LINUX, LINKTYPE_ARCNET_LINUX },
897
898 /* Juniper-internal chassis encapsulation */
899 { DLT_JUNIPER_MLPPP, LINKTYPE_JUNIPER_MLPPP },
900 { DLT_JUNIPER_MLFR, LINKTYPE_JUNIPER_MLFR },
901 { DLT_JUNIPER_ES, LINKTYPE_JUNIPER_ES },
902 { DLT_JUNIPER_GGSN, LINKTYPE_JUNIPER_GGSN },
903 { DLT_JUNIPER_MFR, LINKTYPE_JUNIPER_MFR },
904 { DLT_JUNIPER_ATM2, LINKTYPE_JUNIPER_ATM2 },
905 { DLT_JUNIPER_SERVICES, LINKTYPE_JUNIPER_SERVICES },
906 { DLT_JUNIPER_ATM1, LINKTYPE_JUNIPER_ATM1 },
907
908 /* Apple IP-over-IEEE 1394 cooked header */
909 { DLT_APPLE_IP_OVER_IEEE1394, LINKTYPE_APPLE_IP_OVER_IEEE1394 },
910
911 /* SS7 */
912 { DLT_MTP2_WITH_PHDR, LINKTYPE_MTP2_WITH_PHDR },
913 { DLT_MTP2, LINKTYPE_MTP2 },
914 { DLT_MTP3, LINKTYPE_MTP3 },
915 { DLT_SCCP, LINKTYPE_SCCP },
916
917 /* DOCSIS MAC frames */
918 { DLT_DOCSIS, LINKTYPE_DOCSIS },
919
920 /* IrDA IrLAP packets + Linux-cooked header */
921 { DLT_LINUX_IRDA, LINKTYPE_LINUX_IRDA },
922
923 /* IBM SP and Next Federation switches */
924 { DLT_IBM_SP, LINKTYPE_IBM_SP },
925 { DLT_IBM_SN, LINKTYPE_IBM_SN },
926
927 /* 802.11 plus AVS radio header */
928 { DLT_IEEE802_11_RADIO_AVS, LINKTYPE_IEEE802_11_RADIO_AVS },
929
930 /*
931 * Any platform that defines additional DLT_* codes should:
932 *
933 * request a LINKTYPE_* code and value from tcpdump.org,
934 * as per the above;
935 *
936 * add, in their version of libpcap, an entry to map
937 * those DLT_* codes to the corresponding LINKTYPE_*
938 * code;
939 *
940 * redefine, in their "net/bpf.h", any DLT_* values
941 * that collide with the values used by their additional
942 * DLT_* codes, to remove those collisions (but without
943 * making them collide with any of the LINKTYPE_*
944 * values equal to 50 or above; they should also avoid
945 * defining DLT_* values that collide with those
946 * LINKTYPE_* values, either).
947 */
948
949 /* Juniper-internal chassis encapsulation */
950 { DLT_JUNIPER_MONITOR, LINKTYPE_JUNIPER_MONITOR },
951
952 /* BACnet MS/TP */
953 { DLT_BACNET_MS_TP, LINKTYPE_BACNET_MS_TP },
954
955 /* PPP for pppd, with direction flag in the PPP header */
956 { DLT_PPP_PPPD, LINKTYPE_PPP_PPPD},
957
958 /* Juniper-internal chassis encapsulation */
959 { DLT_JUNIPER_PPPOE, LINKTYPE_JUNIPER_PPPOE },
960 { DLT_JUNIPER_PPPOE_ATM,LINKTYPE_JUNIPER_PPPOE_ATM },
961
962 /* GPRS LLC */
963 { DLT_GPRS_LLC, LINKTYPE_GPRS_LLC },
964
965 /* Transparent Generic Framing Procedure (ITU-T G.7041/Y.1303) */
966 { DLT_GPF_T, LINKTYPE_GPF_T },
967
968 /* Framed Generic Framing Procedure (ITU-T G.7041/Y.1303) */
969 { DLT_GPF_F, LINKTYPE_GPF_F },
970
971 { DLT_GCOM_T1E1, LINKTYPE_GCOM_T1E1 },
972 { DLT_GCOM_SERIAL, LINKTYPE_GCOM_SERIAL },
973
974 /* Juniper-internal chassis encapsulation */
975 { DLT_JUNIPER_PIC_PEER, LINKTYPE_JUNIPER_PIC_PEER },
976
977 /* Endace types */
978 { DLT_ERF_ETH, LINKTYPE_ERF_ETH },
979 { DLT_ERF_POS, LINKTYPE_ERF_POS },
980
981 /* viSDN LAPD */
982 { DLT_LINUX_LAPD, LINKTYPE_LINUX_LAPD },
983
984 /* Juniper meta-information before Ether, PPP, Frame Relay, C-HDLC Frames */
985 { DLT_JUNIPER_ETHER, LINKTYPE_JUNIPER_ETHER },
986 { DLT_JUNIPER_PPP, LINKTYPE_JUNIPER_PPP },
987 { DLT_JUNIPER_FRELAY, LINKTYPE_JUNIPER_FRELAY },
988 { DLT_JUNIPER_CHDLC, LINKTYPE_JUNIPER_CHDLC },
989
990 /* Multi Link Frame Relay (FRF.16) */
991 { DLT_MFR, LINKTYPE_MFR },
992
993 /* Juniper Voice PIC */
994 { DLT_JUNIPER_VP, LINKTYPE_JUNIPER_VP },
995
996 /* Controller Area Network (CAN) v2.0B */
997 { DLT_A429, LINKTYPE_A429 },
998
999 /* Arinc 653 Interpartition Communication messages */
1000 { DLT_A653_ICM, LINKTYPE_A653_ICM },
1001
1002 /* USB */
1003 { DLT_USB, LINKTYPE_USB },
1004
1005 /* Bluetooth HCI UART transport layer */
1006 { DLT_BLUETOOTH_HCI_H4, LINKTYPE_BLUETOOTH_HCI_H4 },
1007
1008 /* IEEE 802.16 MAC Common Part Sublayer */
1009 { DLT_IEEE802_16_MAC_CPS, LINKTYPE_IEEE802_16_MAC_CPS },
1010
1011 /* USB with Linux header */
1012 { DLT_USB_LINUX, LINKTYPE_USB_LINUX },
1013
1014 /* Controller Area Network (CAN) v2.0B */
1015 { DLT_CAN20B, LINKTYPE_CAN20B },
1016
1017 /* IEEE 802.15.4 with address fields padded */
1018 { DLT_IEEE802_15_4_LINUX, LINKTYPE_IEEE802_15_4_LINUX },
1019
1020 /* Per Packet Information encapsulated packets */
1021 { DLT_PPI, LINKTYPE_PPI },
1022
1023 /* IEEE 802.16 MAC Common Part Sublayer plus radiotap header */
1024 { DLT_IEEE802_16_MAC_CPS_RADIO, LINKTYPE_IEEE802_16_MAC_CPS_RADIO },
1025
1026 /* Juniper Voice ISM */
1027 { DLT_JUNIPER_ISM, LINKTYPE_JUNIPER_ISM },
1028
1029 /* IEEE 802.15.4 exactly as it appears in the spec, with FCS */
1030 { DLT_IEEE802_15_4, LINKTYPE_IEEE802_15_4 },
1031
1032 /* Various link-layer types for SITA */
1033 { DLT_SITA, LINKTYPE_SITA },
1034
1035 /* Various link-layer types for Endace */
1036 { DLT_ERF, LINKTYPE_ERF },
1037
1038 /* Special header for u10 Networks boards */
1039 { DLT_RAIF1, LINKTYPE_RAIF1 },
1040
1041 /* IPMB */
1042 { DLT_IPMB, LINKTYPE_IPMB },
1043
1044 /* Juniper Secure Tunnel */
1045 { DLT_JUNIPER_ST, LINKTYPE_JUNIPER_ST },
1046
1047 /* Bluetooth HCI UART transport layer, with pseudo-header */
1048 { DLT_BLUETOOTH_HCI_H4_WITH_PHDR, LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR },
1049
1050 /* AX.25 with KISS header */
1051 { DLT_AX25_KISS, LINKTYPE_AX25_KISS },
1052
1053 /* Raw LAPD, with no pseudo-header */
1054 { DLT_LAPD, LINKTYPE_LAPD },
1055
1056 /* PPP with one-byte pseudo-header giving direction */
1057 { DLT_PPP_WITH_DIR, LINKTYPE_PPP_WITH_DIR },
1058
1059 /* Cisco HDLC with one-byte pseudo-header giving direction */
1060 { DLT_C_HDLC_WITH_DIR, LINKTYPE_C_HDLC_WITH_DIR },
1061
1062 /* Frame Relay with one-byte pseudo-header giving direction */
1063 { DLT_FRELAY_WITH_DIR, LINKTYPE_FRELAY_WITH_DIR },
1064
1065 /* LAPB with one-byte pseudo-header giving direction */
1066 { DLT_LAPB_WITH_DIR, LINKTYPE_LAPB_WITH_DIR },
1067
1068 /* IPMB with Linux pseudo-header */
1069 { DLT_IPMB_LINUX, LINKTYPE_IPMB_LINUX },
1070
1071 /* FlexRay */
1072 { DLT_FLEXRAY, LINKTYPE_FLEXRAY },
1073
1074 /* MOST */
1075 { DLT_MOST, LINKTYPE_MOST },
1076
1077 /* LIN */
1078 { DLT_LIN, LINKTYPE_LIN },
1079
1080 /* X2E-private serial line capture */
1081 { DLT_X2E_SERIAL, LINKTYPE_X2E_SERIAL },
1082
1083 /* X2E-private for Xoraya data logger family */
1084 { DLT_X2E_XORAYA, LINKTYPE_X2E_XORAYA },
1085
1086 /* IEEE 802.15.4 with PHY data for non-ASK PHYs */
1087 { DLT_IEEE802_15_4_NONASK_PHY, LINKTYPE_IEEE802_15_4_NONASK_PHY },
1088
1089 /* Input device events from Linux /dev/input/eventN devices */
1090 { DLT_LINUX_EVDEV, LINKTYPE_LINUX_EVDEV },
1091
1092 /* GSM types */
1093 { DLT_GSMTAP_UM, LINKTYPE_GSMTAP_UM },
1094 { DLT_GSMTAP_ABIS, LINKTYPE_GSMTAP_ABIS },
1095
1096 /* MPLS, with an MPLS label as the link-layer header */
1097 { DLT_MPLS, LINKTYPE_MPLS },
1098
1099 /* USB with padded Linux header */
1100 { DLT_USB_LINUX_MMAPPED, LINKTYPE_USB_LINUX_MMAPPED },
1101
1102 /* DECT packets with a pseudo-header */
1103 { DLT_DECT, LINKTYPE_DECT },
1104
1105 /* AOS Space Data Link Protocol */
1106 { DLT_AOS, LINKTYPE_AOS },
1107
1108 /* Wireless HART */
1109 { DLT_WIHART, LINKTYPE_WIHART },
1110
1111 /* Fibre Channel FC-2 frames without SOF or EOF */
1112 { DLT_FC_2, LINKTYPE_FC_2 },
1113
1114 /* Fibre Channel FC-2 frames with SOF and EOF */
1115 { DLT_FC_2_WITH_FRAME_DELIMS, LINKTYPE_FC_2_WITH_FRAME_DELIMS },
1116
1117 /* Solaris IPNET */
1118 { DLT_IPNET, LINKTYPE_IPNET },
1119
1120 /* CAN frames with SocketCAN headers */
1121 { DLT_CAN_SOCKETCAN, LINKTYPE_CAN_SOCKETCAN },
1122
1123 /* Raw IPv4/IPv6 */
1124 { DLT_IPV4, LINKTYPE_IPV4 },
1125 { DLT_IPV6, LINKTYPE_IPV6 },
1126
1127 /* IEEE 802.15.4 exactly as it appears in the spec, without FCS */
1128 { DLT_IEEE802_15_4_NOFCS, LINKTYPE_IEEE802_15_4_NOFCS },
1129
1130 /* D-Bus messages */
1131 { DLT_DBUS, LINKTYPE_DBUS },
1132
1133 /* Juniper Virtual Server */
1134 { DLT_JUNIPER_VS, LINKTYPE_JUNIPER_VS },
1135
1136 /* Juniper SRX E2E debugging */
1137 { DLT_JUNIPER_SRX_E2E, LINKTYPE_JUNIPER_SRX_E2E },
1138
1139 /* Juniper Fibrechannel */
1140 { DLT_JUNIPER_FIBRECHANNEL, LINKTYPE_JUNIPER_FIBRECHANNEL },
1141
1142 /* DVB-CI */
1143 { DLT_DVB_CI, LINKTYPE_DVB_CI },
1144
1145 /* Variant of 3GPP TS 27.010 */
1146 { DLT_MUX27010, LINKTYPE_MUX27010 },
1147
1148 /* STANAG 5066 D_PDUs */
1149 { DLT_STANAG_5066_D_PDU, LINKTYPE_STANAG_5066_D_PDU },
1150
1151 /* Juniper ATM CE MIC */
1152 { DLT_JUNIPER_ATM_CEMIC, LINKTYPE_JUNIPER_ATM_CEMIC },
1153
1154 { -1, -1 }
1155 };
1156
1157 int
1158 dlt_to_linktype(int dlt)
1159 {
1160 int i;
1161
1162 for (i = 0; map[i].dlt != -1; i++) {
1163 if (map[i].dlt == dlt)
1164 return (map[i].linktype);
1165 }
1166
1167 /*
1168 * If we don't have a mapping for this DLT_ code, return an
1169 * error; that means that the table above needs to have an
1170 * entry added.
1171 */
1172 return (-1);
1173 }
1174
1175 int
1176 linktype_to_dlt(int linktype)
1177 {
1178 int i;
1179
1180 for (i = 0; map[i].linktype != -1; i++) {
1181 if (map[i].linktype == linktype)
1182 return (map[i].dlt);
1183 }
1184
1185 /*
1186 * If we don't have an entry for this link type, return
1187 * the link type value; it may be a DLT_ value from an
1188 * older version of libpcap.
1189 */
1190 return linktype;
1191 }
1192
1193 /*
1194 * The DLT_USB_LINUX and DLT_USB_LINUX_MMAPPED headers are in host
1195 * byte order when capturing (it's supplied directly from a
1196 * memory-mapped buffer shared by the kernel).
1197 *
1198 * When reading a DLT_USB_LINUX or DLT_USB_LINUX_MMAPPED capture file,
1199 * we need to convert it from the capturing host's byte order to
1200 * the reading host's byte order.
1201 */
1202 void
1203 swap_linux_usb_header(const struct pcap_pkthdr *hdr, u_char *buf,
1204 int header_len_64_bytes)
1205 {
1206 pcap_usb_header_mmapped *uhdr = (pcap_usb_header_mmapped *)buf;
1207 bpf_u_int32 offset = 0;
1208 usb_isodesc *pisodesc;
1209 int32_t numdesc, i;
1210
1211 /*
1212 * "offset" is the offset *past* the field we're swapping;
1213 * we skip the field *before* checking to make sure
1214 * the captured data length includes the entire field.
1215 */
1216
1217 /*
1218 * The URB id is a totally opaque value; do we really need to
1219 * convert it to the reading host's byte order???
1220 */
1221 offset += 8; /* skip past id */
1222 if (hdr->caplen < offset)
1223 return;
1224 uhdr->id = SWAPLL(uhdr->id);
1225
1226 offset += 4; /* skip past various 1-byte fields */
1227
1228 offset += 2; /* skip past bus_id */
1229 if (hdr->caplen < offset)
1230 return;
1231 uhdr->bus_id = SWAPSHORT(uhdr->bus_id);
1232
1233 offset += 2; /* skip past various 1-byte fields */
1234
1235 offset += 8; /* skip past ts_sec */
1236 if (hdr->caplen < offset)
1237 return;
1238 uhdr->ts_sec = SWAPLL(uhdr->ts_sec);
1239
1240 offset += 4; /* skip past ts_usec */
1241 if (hdr->caplen < offset)
1242 return;
1243 uhdr->ts_usec = SWAPLONG(uhdr->ts_usec);
1244
1245 offset += 4; /* skip past status */
1246 if (hdr->caplen < offset)
1247 return;
1248 uhdr->status = SWAPLONG(uhdr->status);
1249
1250 offset += 4; /* skip past urb_len */
1251 if (hdr->caplen < offset)
1252 return;
1253 uhdr->urb_len = SWAPLONG(uhdr->urb_len);
1254
1255 offset += 4; /* skip past data_len */
1256 if (hdr->caplen < offset)
1257 return;
1258 uhdr->data_len = SWAPLONG(uhdr->data_len);
1259
1260 if (uhdr->transfer_type == URB_ISOCHRONOUS) {
1261 offset += 4; /* skip past s.iso.error_count */
1262 if (hdr->caplen < offset)
1263 return;
1264 uhdr->s.iso.error_count = SWAPLONG(uhdr->s.iso.error_count);
1265
1266 offset += 4; /* skip past s.iso.numdesc */
1267 if (hdr->caplen < offset)
1268 return;
1269 uhdr->s.iso.numdesc = SWAPLONG(uhdr->s.iso.numdesc);
1270 } else
1271 offset += 8; /* skip USB setup header */
1272
1273 if (header_len_64_bytes) {
1274 /*
1275 * This is either the "version 1" header, with
1276 * 16 bytes of additional fields at the end, or
1277 * a "version 0" header from a memory-mapped
1278 * capture, with 16 bytes of zeroed-out padding
1279 * at the end. Byte swap them as if this were
1280 * a "version 1" header.
1281 */
1282 offset += 4; /* skip past interval */
1283 if (hdr->caplen < offset)
1284 return;
1285 uhdr->interval = SWAPLONG(uhdr->interval);
1286
1287 offset += 4; /* skip past start_frame */
1288 if (hdr->caplen < offset)
1289 return;
1290 uhdr->start_frame = SWAPLONG(uhdr->start_frame);
1291
1292 offset += 4; /* skip past xfer_flags */
1293 if (hdr->caplen < offset)
1294 return;
1295 uhdr->xfer_flags = SWAPLONG(uhdr->xfer_flags);
1296
1297 offset += 4; /* skip past ndesc */
1298 if (hdr->caplen < offset)
1299 return;
1300 uhdr->ndesc = SWAPLONG(uhdr->ndesc);
1301 }
1302
1303 if (uhdr->transfer_type == URB_ISOCHRONOUS) {
1304 /* swap the values in struct linux_usb_isodesc */
1305 pisodesc = (usb_isodesc *)(void *)(buf+offset);
1306 numdesc = uhdr->s.iso.numdesc;
1307 for (i = 0; i < numdesc; i++) {
1308 offset += 4; /* skip past status */
1309 if (hdr->caplen < offset)
1310 return;
1311 pisodesc->status = SWAPLONG(pisodesc->status);
1312
1313 offset += 4; /* skip past offset */
1314 if (hdr->caplen < offset)
1315 return;
1316 pisodesc->offset = SWAPLONG(pisodesc->offset);
1317
1318 offset += 4; /* skip past len */
1319 if (hdr->caplen < offset)
1320 return;
1321 pisodesc->len = SWAPLONG(pisodesc->len);
1322
1323 offset += 4; /* skip past padding */
1324
1325 pisodesc++;
1326 }
1327 }
1328 }
[mirror] the LIBpcap interface to various kernel packet capture mechanism