The Tcpdump Group git mirrors - libpcap/blob - pcap-common.c

   1 /*
   2  * Copyright (c) 1993, 1994, 1995, 1996, 1997
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * savefile.c - supports offline use of tcpdump
  22  *      Extraction/creation by Jeffrey Mogul, DECWRL
  23  *      Modified by Steve McCanne, LBL.
  24  *
  25  * Used to save the received packet headers, after filtering, to
  26  * a file, and then read them later.
  27  * The first record in the file contains saved values for the machine
  28  * dependent values so we can print the dump file on any architecture.
  29  */
  30
  31 #ifndef lint
  32 static const char rcsid[] _U_ =
  33     "@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.183 2008-12-23 20:13:29 guy Exp $ (LBL)";
  34 #endif
  35
  36 #ifdef HAVE_CONFIG_H
  37 #include "config.h"
  38 #endif
  39
  40 #ifdef WIN32
  41 #include <pcap-stdinc.h>
  42 #else /* WIN32 */
  43 #if HAVE_INTTYPES_H
  44 #include <inttypes.h>
  45 #elif HAVE_STDINT_H
  46 #include <stdint.h>
  47 #endif
  48 #ifdef HAVE_SYS_BITYPES_H
  49 #include <sys/bitypes.h>
  50 #endif
  51 #include <sys/types.h>
  52 #endif /* WIN32 */
  53
  54 #include "pcap-int.h"
  55 #include "pcap/usb.h"
  56
  57 #include "pcap-common.h"
  58
  59 /*
  60  * We don't write DLT_* values to capture files, because they're not the
  61  * same on all platforms.
  62  *
  63  * Unfortunately, the various flavors of BSD have not always used the same
  64  * numerical values for the same data types, and various patches to
  65  * libpcap for non-BSD OSes have added their own DLT_* codes for link
  66  * layer encapsulation types seen on those OSes, and those codes have had,
  67  * in some cases, values that were also used, on other platforms, for other
  68  * link layer encapsulation types.
  69  *
  70  * This means that capture files of a type whose numerical DLT_* code
  71  * means different things on different BSDs, or with different versions
  72  * of libpcap, can't always be read on systems other than those like
  73  * the one running on the machine on which the capture was made.
  74  *
  75  * Instead, we define here a set of LINKTYPE_* codes, and map DLT_* codes
  76  * to LINKTYPE_* codes when writing a savefile header, and map LINKTYPE_*
  77  * codes to DLT_* codes when reading a savefile header.
  78  *
  79  * For those DLT_* codes that have, as far as we know, the same values on
  80  * all platforms (DLT_NULL through DLT_FDDI), we define LINKTYPE_xxx as
  81  * DLT_xxx; that way, captures of those types can still be read by
  82  * versions of libpcap that map LINKTYPE_* values to DLT_* values, and
  83  * captures of those types written by versions of libpcap that map DLT_
  84  * values to LINKTYPE_ values can still be read by older versions
  85  * of libpcap.
  86  *
  87  * The other LINKTYPE_* codes are given values starting at 100, in the
  88  * hopes that no DLT_* code will be given one of those values.
  89  *
  90  * In order to ensure that a given LINKTYPE_* code's value will refer to
  91  * the same encapsulation type on all platforms, you should not allocate
  92  * a new LINKTYPE_* value without consulting
  93  * "tcpdump-workers@lists.tcpdump.org".  The tcpdump developers will
  94  * allocate a value for you, and will not subsequently allocate it to
  95  * anybody else; that value will be added to the "pcap.h" in the
  96  * tcpdump.org Git repository, so that a future libpcap release will
  97  * include it.
  98  *
  99  * You should, if possible, also contribute patches to libpcap and tcpdump
 100  * to handle the new encapsulation type, so that they can also be checked
 101  * into the tcpdump.org Git repository and so that they will appear in
 102  * future libpcap and tcpdump releases.
 103  *
 104  * Do *NOT* assume that any values after the largest value in this file
 105  * are available; you might not have the most up-to-date version of this
 106  * file, and new values after that one might have been assigned.  Also,
 107  * do *NOT* use any values below 100 - those might already have been
 108  * taken by one (or more!) organizations.
 109  */
 110 #define LINKTYPE_NULL           DLT_NULL
 111 #define LINKTYPE_ETHERNET       DLT_EN10MB      /* also for 100Mb and up */
 112 #define LINKTYPE_EXP_ETHERNET   DLT_EN3MB       /* 3Mb experimental Ethernet */
 113 #define LINKTYPE_AX25           DLT_AX25
 114 #define LINKTYPE_PRONET         DLT_PRONET
 115 #define LINKTYPE_CHAOS          DLT_CHAOS
 116 #define LINKTYPE_TOKEN_RING     DLT_IEEE802     /* DLT_IEEE802 is used for Token Ring */
 117 #define LINKTYPE_ARCNET         DLT_ARCNET      /* BSD-style headers */
 118 #define LINKTYPE_SLIP           DLT_SLIP
 119 #define LINKTYPE_PPP            DLT_PPP
 120 #define LINKTYPE_FDDI           DLT_FDDI
 121
 122 /*
 123  * LINKTYPE_PPP is for use when there might, or might not, be an RFC 1662
 124  * PPP in HDLC-like framing header (with 0xff 0x03 before the PPP protocol
 125  * field) at the beginning of the packet.
 126  *
 127  * This is for use when there is always such a header; the address field
 128  * might be 0xff, for regular PPP, or it might be an address field for Cisco
 129  * point-to-point with HDLC framing as per section 4.3.1 of RFC 1547 ("Cisco
 130  * HDLC").  This is, for example, what you get with NetBSD's DLT_PPP_SERIAL.
 131  *
 132  * We give it the same value as NetBSD's DLT_PPP_SERIAL, in the hopes that
 133  * nobody else will choose a DLT_ value of 50, and so that DLT_PPP_SERIAL
 134  * captures will be written out with a link type that NetBSD's tcpdump
 135  * can read.
 136  */
 137 #define LINKTYPE_PPP_HDLC       50              /* PPP in HDLC-like framing */
 138
 139 #define LINKTYPE_PPP_ETHER      51              /* NetBSD PPP-over-Ethernet */
 140
 141 #define LINKTYPE_SYMANTEC_FIREWALL 99           /* Symantec Enterprise Firewall */
 142
 143 #define LINKTYPE_ATM_RFC1483    100             /* LLC/SNAP-encapsulated ATM */
 144 #define LINKTYPE_RAW            101             /* raw IP */
 145 #define LINKTYPE_SLIP_BSDOS     102             /* BSD/OS SLIP BPF header */
 146 #define LINKTYPE_PPP_BSDOS      103             /* BSD/OS PPP BPF header */
 147 #define LINKTYPE_C_HDLC         104             /* Cisco HDLC */
 148 #define LINKTYPE_IEEE802_11     105             /* IEEE 802.11 (wireless) */
 149 #define LINKTYPE_ATM_CLIP       106             /* Linux Classical IP over ATM */
 150 #define LINKTYPE_FRELAY         107             /* Frame Relay */
 151 #define LINKTYPE_LOOP           108             /* OpenBSD loopback */
 152 #define LINKTYPE_ENC            109             /* OpenBSD IPSEC enc */
 153
 154 /*
 155  * These three types are reserved for future use.
 156  */
 157 #define LINKTYPE_LANE8023       110             /* ATM LANE + 802.3 */
 158 #define LINKTYPE_HIPPI          111             /* NetBSD HIPPI */
 159 #define LINKTYPE_HDLC           112             /* NetBSD HDLC framing */
 160
 161 #define LINKTYPE_LINUX_SLL      113             /* Linux cooked socket capture */
 162 #define LINKTYPE_LTALK          114             /* Apple LocalTalk hardware */
 163 #define LINKTYPE_ECONET         115             /* Acorn Econet */
 164
 165 /*
 166  * Reserved for use with OpenBSD ipfilter.
 167  */
 168 #define LINKTYPE_IPFILTER       116
 169
 170 #define LINKTYPE_PFLOG          117             /* OpenBSD DLT_PFLOG */
 171 #define LINKTYPE_CISCO_IOS      118             /* For Cisco-internal use */
 172 #define LINKTYPE_PRISM_HEADER   119             /* 802.11+Prism II monitor mode */
 173 #define LINKTYPE_AIRONET_HEADER 120             /* FreeBSD Aironet driver stuff */
 174
 175 /*
 176  * Reserved for Siemens HiPath HDLC.
 177  */
 178 #define LINKTYPE_HHDLC          121
 179
 180 #define LINKTYPE_IP_OVER_FC     122             /* RFC 2625 IP-over-Fibre Channel */
 181 #define LINKTYPE_SUNATM         123             /* Solaris+SunATM */
 182
 183 /*
 184  * Reserved as per request from Kent Dahlgren <kent@praesum.com>
 185  * for private use.
 186  */
 187 #define LINKTYPE_RIO            124             /* RapidIO */
 188 #define LINKTYPE_PCI_EXP        125             /* PCI Express */
 189 #define LINKTYPE_AURORA         126             /* Xilinx Aurora link layer */
 190
 191 #define LINKTYPE_IEEE802_11_RADIO 127           /* 802.11 plus BSD radio header */
 192
 193 /*
 194  * Reserved for the TZSP encapsulation, as per request from
 195  * Chris Waters <chris.waters@networkchemistry.com>
 196  * TZSP is a generic encapsulation for any other link type,
 197  * which includes a means to include meta-information
 198  * with the packet, e.g. signal strength and channel
 199  * for 802.11 packets.
 200  */
 201 #define LINKTYPE_TZSP           128             /* Tazmen Sniffer Protocol */
 202
 203 #define LINKTYPE_ARCNET_LINUX   129             /* Linux-style headers */
 204
 205 /*
 206  * Juniper-private data link types, as per request from
 207  * Hannes Gredler <hannes@juniper.net>.  The corresponding
 208  * DLT_s are used for passing on chassis-internal
 209  * metainformation such as QOS profiles, etc..
 210  */
 211 #define LINKTYPE_JUNIPER_MLPPP  130
 212 #define LINKTYPE_JUNIPER_MLFR   131
 213 #define LINKTYPE_JUNIPER_ES     132
 214 #define LINKTYPE_JUNIPER_GGSN   133
 215 #define LINKTYPE_JUNIPER_MFR    134
 216 #define LINKTYPE_JUNIPER_ATM2   135
 217 #define LINKTYPE_JUNIPER_SERVICES 136
 218 #define LINKTYPE_JUNIPER_ATM1   137
 219
 220 #define LINKTYPE_APPLE_IP_OVER_IEEE1394 138     /* Apple IP-over-IEEE 1394 cooked header */
 221
 222 #define LINKTYPE_MTP2_WITH_PHDR 139
 223 #define LINKTYPE_MTP2           140
 224 #define LINKTYPE_MTP3           141
 225 #define LINKTYPE_SCCP           142
 226
 227 #define LINKTYPE_DOCSIS         143             /* DOCSIS MAC frames */
 228
 229 #define LINKTYPE_LINUX_IRDA     144             /* Linux-IrDA */
 230
 231 /*
 232  * Reserved for IBM SP switch and IBM Next Federation switch.
 233  */
 234 #define LINKTYPE_IBM_SP         145
 235 #define LINKTYPE_IBM_SN         146
 236
 237 /*
 238  * Reserved for private use.  If you have some link-layer header type
 239  * that you want to use within your organization, with the capture files
 240  * using that link-layer header type not ever be sent outside your
 241  * organization, you can use these values.
 242  *
 243  * No libpcap release will use these for any purpose, nor will any
 244  * tcpdump release use them, either.
 245  *
 246  * Do *NOT* use these in capture files that you expect anybody not using
 247  * your private versions of capture-file-reading tools to read; in
 248  * particular, do *NOT* use them in products, otherwise you may find that
 249  * people won't be able to use tcpdump, or snort, or Ethereal, or... to
 250  * read capture files from your firewall/intrusion detection/traffic
 251  * monitoring/etc. appliance, or whatever product uses that LINKTYPE_ value,
 252  * and you may also find that the developers of those applications will
 253  * not accept patches to let them read those files.
 254  *
 255  * Also, do not use them if somebody might send you a capture using them
 256  * for *their* private type and tools using them for *your* private type
 257  * would have to read them.
 258  *
 259  * Instead, in those cases, ask "tcpdump-workers@lists.tcpdump.org" for a
 260  * new DLT_ and LINKTYPE_ value, as per the comment in pcap/bpf.h, and use
 261  * the type you're given.
 262  */
 263 #define LINKTYPE_USER0          147
 264 #define LINKTYPE_USER1          148
 265 #define LINKTYPE_USER2          149
 266 #define LINKTYPE_USER3          150
 267 #define LINKTYPE_USER4          151
 268 #define LINKTYPE_USER5          152
 269 #define LINKTYPE_USER6          153
 270 #define LINKTYPE_USER7          154
 271 #define LINKTYPE_USER8          155
 272 #define LINKTYPE_USER9          156
 273 #define LINKTYPE_USER10         157
 274 #define LINKTYPE_USER11         158
 275 #define LINKTYPE_USER12         159
 276 #define LINKTYPE_USER13         160
 277 #define LINKTYPE_USER14         161
 278 #define LINKTYPE_USER15         162
 279
 280 /*
 281  * For future use with 802.11 captures - defined by AbsoluteValue
 282  * Systems to store a number of bits of link-layer information
 283  * including radio information:
 284  *
 285  *      http://www.shaftnet.org/~pizza/software/capturefrm.txt
 286  *
 287  * but could and arguably should also be used by non-AVS Linux
 288  * 802.11 drivers; that may happen in the future.
 289  */
 290 #define LINKTYPE_IEEE802_11_RADIO_AVS 163       /* 802.11 plus AVS radio header */
 291
 292 /*
 293  * Juniper-private data link type, as per request from
 294  * Hannes Gredler <hannes@juniper.net>.  The corresponding
 295  * DLT_s are used for passing on chassis-internal
 296  * metainformation such as QOS profiles, etc..
 297  */
 298 #define LINKTYPE_JUNIPER_MONITOR 164
 299
 300 /*
 301  * Reserved for BACnet MS/TP.
 302  */
 303 #define LINKTYPE_BACNET_MS_TP   165
 304
 305 /*
 306  * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>.
 307  *
 308  * This is used in some OSes to allow a kernel socket filter to distinguish
 309  * between incoming and outgoing packets, on a socket intended to
 310  * supply pppd with outgoing packets so it can do dial-on-demand and
 311  * hangup-on-lack-of-demand; incoming packets are filtered out so they
 312  * don't cause pppd to hold the connection up (you don't want random
 313  * input packets such as port scans, packets from old lost connections,
 314  * etc. to force the connection to stay up).
 315  *
 316  * The first byte of the PPP header (0xff03) is modified to accomodate
 317  * the direction - 0x00 = IN, 0x01 = OUT.
 318  */
 319 #define LINKTYPE_PPP_PPPD       166
 320
 321 /*
 322  * Juniper-private data link type, as per request from
 323  * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
 324  * for passing on chassis-internal metainformation such as
 325  * QOS profiles, cookies, etc..
 326  */
 327 #define LINKTYPE_JUNIPER_PPPOE     167
 328 #define LINKTYPE_JUNIPER_PPPOE_ATM 168
 329
 330 #define LINKTYPE_GPRS_LLC       169             /* GPRS LLC */
 331 #define LINKTYPE_GPF_T          170             /* GPF-T (ITU-T G.7041/Y.1303) */
 332 #define LINKTYPE_GPF_F          171             /* GPF-T (ITU-T G.7041/Y.1303) */
 333
 334 /*
 335  * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line
 336  * monitoring equipment.
 337  */
 338 #define LINKTYPE_GCOM_T1E1      172
 339 #define LINKTYPE_GCOM_SERIAL    173
 340
 341 /*
 342  * Juniper-private data link type, as per request from
 343  * Hannes Gredler <hannes@juniper.net>.  The DLT_ is used
 344  * for internal communication to Physical Interface Cards (PIC)
 345  */
 346 #define LINKTYPE_JUNIPER_PIC_PEER    174
 347
 348 /*
 349  * Link types requested by Gregor Maier <gregor@endace.com> of Endace
 350  * Measurement Systems.  They add an ERF header (see
 351  * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of
 352  * the link-layer header.
 353  */
 354 #define LINKTYPE_ERF_ETH        175     /* Ethernet */
 355 #define LINKTYPE_ERF_POS        176     /* Packet-over-SONET */
 356
 357 /*
 358  * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD
 359  * for vISDN (http://www.orlandi.com/visdn/).  Its link-layer header
 360  * includes additional information before the LAPD header, so it's
 361  * not necessarily a generic LAPD header.
 362  */
 363 #define LINKTYPE_LINUX_LAPD     177
 364
 365 /*
 366  * Juniper-private data link type, as per request from
 367  * Hannes Gredler <hannes@juniper.net>.
 368  * The Link Types are used for prepending meta-information
 369  * like interface index, interface name
 370  * before standard Ethernet, PPP, Frelay & C-HDLC Frames
 371  */
 372 #define LINKTYPE_JUNIPER_ETHER  178
 373 #define LINKTYPE_JUNIPER_PPP    179
 374 #define LINKTYPE_JUNIPER_FRELAY 180
 375 #define LINKTYPE_JUNIPER_CHDLC  181
 376
 377 /*
 378  * Multi Link Frame Relay (FRF.16)
 379  */
 380 #define LINKTYPE_MFR            182
 381
 382 /*
 383  * Juniper-private data link type, as per request from
 384  * Hannes Gredler <hannes@juniper.net>.
 385  * The DLT_ is used for internal communication with a
 386  * voice Adapter Card (PIC)
 387  */
 388 #define LINKTYPE_JUNIPER_VP     183
 389
 390 /*
 391  * Arinc 429 frames.
 392  * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
 393  * Every frame contains a 32bit A429 label.
 394  * More documentation on Arinc 429 can be found at
 395  * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
 396  */
 397 #define LINKTYPE_A429           184
 398
 399 /*
 400  * Arinc 653 Interpartition Communication messages.
 401  * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
 402  * Please refer to the A653-1 standard for more information.
 403  */
 404 #define LINKTYPE_A653_ICM       185
 405
 406 /*
 407  * USB packets, beginning with a USB setup header; requested by
 408  * Paolo Abeni <paolo.abeni@email.it>.
 409  */
 410 #define LINKTYPE_USB            186
 411
 412 /*
 413  * Bluetooth HCI UART transport layer (part H:4); requested by
 414  * Paolo Abeni.
 415  */
 416 #define LINKTYPE_BLUETOOTH_HCI_H4       187
 417
 418 /*
 419  * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
 420  * <cruz_petagay@bah.com>.
 421  */
 422 #define LINKTYPE_IEEE802_16_MAC_CPS     188
 423
 424 /*
 425  * USB packets, beginning with a Linux USB header; requested by
 426  * Paolo Abeni <paolo.abeni@email.it>.
 427  */
 428 #define LINKTYPE_USB_LINUX              189
 429
 430 /*
 431  * Controller Area Network (CAN) v. 2.0B packets.
 432  * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
 433  * Used to dump CAN packets coming from a CAN Vector board.
 434  * More documentation on the CAN v2.0B frames can be found at
 435  * http://www.can-cia.org/downloads/?269
 436  */
 437 #define LINKTYPE_CAN20B         190
 438
 439 /*
 440  * IEEE 802.15.4, with address fields padded, as is done by Linux
 441  * drivers; requested by Juergen Schimmer.
 442  */
 443 #define LINKTYPE_IEEE802_15_4_LINUX     191
 444
 445 /*
 446  * Per Packet Information encapsulated packets.
 447  * LINKTYPE_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
 448  */
 449 #define LINKTYPE_PPI                    192
 450
 451 /*
 452  * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
 453  * requested by Charles Clancy.
 454  */
 455 #define LINKTYPE_IEEE802_16_MAC_CPS_RADIO       193
 456
 457 /*
 458  * Juniper-private data link type, as per request from
 459  * Hannes Gredler <hannes@juniper.net>.
 460  * The DLT_ is used for internal communication with a
 461  * integrated service module (ISM).
 462  */
 463 #define LINKTYPE_JUNIPER_ISM    194
 464
 465 /*
 466  * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
 467  * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.
 468  */
 469 #define LINKTYPE_IEEE802_15_4   195
 470
 471 /*
 472  * Various link-layer types, with a pseudo-header, for SITA
 473  * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).
 474  */
 475 #define LINKTYPE_SITA           196
 476
 477 /*
 478  * Various link-layer types, with a pseudo-header, for Endace DAG cards;
 479  * encapsulates Endace ERF records.  Requested by Stephen Donnelly
 480  * <stephen@endace.com>.
 481  */
 482 #define LINKTYPE_ERF            197
 483
 484 /*
 485  * Special header prepended to Ethernet packets when capturing from a
 486  * u10 Networks board.  Requested by Phil Mulholland
 487  * <phil@u10networks.com>.
 488  */
 489 #define LINKTYPE_RAIF1          198
 490
 491 /*
 492  * IPMB packet for IPMI, beginning with the I2C slave address, followed
 493  * by the netFn and LUN, etc..  Requested by Chanthy Toeung
 494  * <chanthy.toeung@ca.kontron.com>.
 495  */
 496 #define LINKTYPE_IPMB           199
 497
 498 /*
 499  * Juniper-private data link type, as per request from
 500  * Hannes Gredler <hannes@juniper.net>.
 501  * The DLT_ is used for capturing data on a secure tunnel interface.
 502  */
 503 #define LINKTYPE_JUNIPER_ST     200
 504
 505 /*
 506  * Bluetooth HCI UART transport layer (part H:4), with pseudo-header
 507  * that includes direction information; requested by Paolo Abeni.
 508  */
 509 #define LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR     201
 510
 511 /*
 512  * AX.25 packet with a 1-byte KISS header; see
 513  *
 514  *      http://www.ax25.net/kiss.htm
 515  *
 516  * as per Richard Stearn <richard@rns-stearn.demon.co.uk>.
 517  */
 518 #define LINKTYPE_AX25_KISS      202
 519
 520 /*
 521  * LAPD packets from an ISDN channel, starting with the address field,
 522  * with no pseudo-header.
 523  * Requested by Varuna De Silva <varunax@gmail.com>.
 524  */
 525 #define LINKTYPE_LAPD           203
 526
 527 /*
 528  * Variants of various link-layer headers, with a one-byte direction
 529  * pseudo-header prepended - zero means "received by this host",
 530  * non-zero (any non-zero value) means "sent by this host" - as per
 531  * Will Barker <w.barker@zen.co.uk>.
 532  */
 533 #define LINKTYPE_PPP_WITH_DIR   204     /* PPP */
 534 #define LINKTYPE_C_HDLC_WITH_DIR 205    /* Cisco HDLC */
 535 #define LINKTYPE_FRELAY_WITH_DIR 206    /* Frame Relay */
 536 #define LINKTYPE_LAPB_WITH_DIR  207     /* LAPB */
 537
 538 /*
 539  * 208 is reserved for an as-yet-unspecified proprietary link-layer
 540  * type, as requested by Will Barker.
 541  */
 542
 543 /*
 544  * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman
 545  * <avn@pigeonpoint.com>.
 546  */
 547 #define LINKTYPE_IPMB_LINUX             209
 548
 549 /*
 550  * FlexRay automotive bus - http://www.flexray.com/ - as requested
 551  * by Hannes Kaelber <hannes.kaelber@x2e.de>.
 552  */
 553 #define LINKTYPE_FLEXRAY                210
 554
 555 /*
 556  * Media Oriented Systems Transport (MOST) bus for multimedia
 557  * transport - http://www.mostcooperation.com/ - as requested
 558  * by Hannes Kaelber <hannes.kaelber@x2e.de>.
 559  */
 560 #define LINKTYPE_MOST                   211
 561
 562 /*
 563  * Local Interconnect Network (LIN) bus for vehicle networks -
 564  * http://www.lin-subbus.org/ - as requested by Hannes Kaelber
 565  * <hannes.kaelber@x2e.de>.
 566  */
 567 #define LINKTYPE_LIN                    212
 568
 569 /*
 570  * X2E-private data link type used for serial line capture,
 571  * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
 572  */
 573 #define LINKTYPE_X2E_SERIAL             213
 574
 575 /*
 576  * X2E-private data link type used for the Xoraya data logger
 577  * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
 578  */
 579 #define LINKTYPE_X2E_XORAYA             214
 580
 581 /*
 582  * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
 583  * nothing), but with the PHY-level data for non-ASK PHYs (4 octets
 584  * of 0 as preamble, one octet of SFD, one octet of frame length+
 585  * reserved bit, and then the MAC-layer data, starting with the
 586  * frame control field).
 587  *
 588  * Requested by Max Filippov <jcmvbkbc@gmail.com>.
 589  */
 590 #define LINKTYPE_IEEE802_15_4_NONASK_PHY        215
 591
 592 /*
 593  * David Gibson <david@gibson.dropbear.id.au> requested this for
 594  * captures from the Linux kernel /dev/input/eventN devices. This
 595  * is used to communicate keystrokes and mouse movements from the
 596  * Linux kernel to display systems, such as Xorg.
 597  */
 598 #define LINKTYPE_LINUX_EVDEV                    216
 599
 600 /*
 601  * GSM Um and Abis interfaces, preceded by a "gsmtap" header.
 602  *
 603  * Requested by Harald Welte <laforge@gnumonks.org>.
 604  */
 605 #define LINKTYPE_GSMTAP_UM                      217
 606 #define LINKTYPE_GSMTAP_ABIS                    218
 607
 608 /*
 609  * MPLS, with an MPLS label as the link-layer header.
 610  * Requested by Michele Marchetto <michele@openbsd.org> on behalf
 611  * of OpenBSD.
 612  */
 613 #define LINKTYPE_MPLS                           219
 614
 615 /*
 616  * USB packets, beginning with a Linux USB header, with the USB header
 617  * padded to 64 bytes; required for memory-mapped access.
 618  */
 619 #define LINKTYPE_USB_LINUX_MMAPPED              220
 620
 621 /*
 622  * DECT packets, with a pseudo-header; requested by
 623  * Matthias Wenzel <tcpdump@mazzoo.de>.
 624  */
 625 #define LINKTYPE_DECT                           221
 626
 627 /*
 628  * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov>
 629  * Date: Mon, 11 May 2009 11:18:30 -0500
 630  *
 631  * DLT_AOS. We need it for AOS Space Data Link Protocol.
 632  *   I have already written dissectors for but need an OK from
 633  *   legal before I can submit a patch.
 634  *
 635  */
 636 #define LINKTYPE_AOS                            222
 637
 638 /*
 639  * Wireless HART (Highway Addressable Remote Transducer)
 640  * From the HART Communication Foundation
 641  * IES/PAS 62591
 642  *
 643  * Requested by Sam Roberts <vieuxtech@gmail.com>.
 644  */
 645 #define LINKTYPE_WIHART                         223
 646
 647 /*
 648  * Fibre Channel FC-2 frames, beginning with a Frame_Header.
 649  * Requested by Kahou Lei <kahou82@gmail.com>.
 650  */
 651 #define LINKTYPE_FC_2                           224
 652
 653 /*
 654  * Fibre Channel FC-2 frames, beginning with an encoding of the
 655  * SOF, and ending with an encoding of the EOF.
 656  *
 657  * The encodings represent the frame delimiters as 4-byte sequences
 658  * representing the corresponding ordered sets, with K28.5
 659  * represented as 0xBC, and the D symbols as the corresponding
 660  * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2,
 661  * is represented as 0xBC 0xB5 0x55 0x55.
 662  *
 663  * Requested by Kahou Lei <kahou82@gmail.com>.
 664  */
 665 #define LINKTYPE_FC_2_WITH_FRAME_DELIMS         225
 666
 667 /*
 668  * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>.
 669  *
 670  * The pseudo-header starts with a one-byte version number; for version 2,
 671  * the pseudo-header is:
 672  *
 673  * struct dl_ipnetinfo {
 674  *     u_int8_t   dli_version;
 675  *     u_int8_t   dli_family;
 676  *     u_int16_t  dli_htype;
 677  *     u_int32_t  dli_pktlen;
 678  *     u_int32_t  dli_ifindex;
 679  *     u_int32_t  dli_grifindex;
 680  *     u_int32_t  dli_zsrc;
 681  *     u_int32_t  dli_zdst;
 682  * };
 683  *
 684  * dli_version is 2 for the current version of the pseudo-header.
 685  *
 686  * dli_family is a Solaris address family value, so it's 2 for IPv4
 687  * and 26 for IPv6.
 688  *
 689  * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing
 690  * packets, and 2 for packets arriving from another zone on the same
 691  * machine.
 692  *
 693  * dli_pktlen is the length of the packet data following the pseudo-header
 694  * (so the captured length minus dli_pktlen is the length of the
 695  * pseudo-header, assuming the entire pseudo-header was captured).
 696  *
 697  * dli_ifindex is the interface index of the interface on which the
 698  * packet arrived.
 699  *
 700  * dli_grifindex is the group interface index number (for IPMP interfaces).
 701  *
 702  * dli_zsrc is the zone identifier for the source of the packet.
 703  *
 704  * dli_zdst is the zone identifier for the destination of the packet.
 705  *
 706  * A zone number of 0 is the global zone; a zone number of 0xffffffff
 707  * means that the packet arrived from another host on the network, not
 708  * from another zone on the same machine.
 709  *
 710  * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates
 711  * which of those it is.
 712  */
 713 #define LINKTYPE_IPNET                          226
 714
 715 /*
 716  * CAN (Controller Area Network) frames, with a pseudo-header as supplied
 717  * by Linux SocketCAN.  See Documentation/networking/can.txt in the Linux
 718  * source.
 719  *
 720  * Requested by Felix Obenhuber <felix@obenhuber.de>.
 721  */
 722 #define LINKTYPE_CAN_SOCKETCAN                  227
 723
 724 /*
 725  * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies
 726  * whether it's v4 or v6.  Requested by Darren Reed <Darren.Reed@Sun.COM>.
 727  */
 728 #define LINKTYPE_IPV4                           228
 729 #define LINKTYPE_IPV6                           229
 730
 731 /*
 732  * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
 733  * nothing), and with no FCS at the end of the frame; requested by
 734  * Jon Smirl <jonsmirl@gmail.com>.
 735  */
 736 #define LINKTYPE_IEEE802_15_4_NOFCS             230
 737
 738 /*
 739  * Raw D-Bus:
 740  *
 741  *      http://www.freedesktop.org/wiki/Software/dbus
 742  *
 743  * messages:
 744  *
 745  *      http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages
 746  *
 747  * starting with the endianness flag, followed by the message type, etc.,
 748  * but without the authentication handshake before the message sequence:
 749  *
 750  *      http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol
 751  *
 752  * Requested by Martin Vidner <martin@vidner.net>.
 753  */
 754 #define LINKTYPE_DBUS                           231
 755
 756 /*
 757  * Juniper-private data link type, as per request from
 758  * Hannes Gredler <hannes@juniper.net>.
 759  */
 760 #define LINKTYPE_JUNIPER_VS                     232
 761 #define LINKTYPE_JUNIPER_SRX_E2E                233
 762 #define LINKTYPE_JUNIPER_FIBRECHANNEL           234
 763
 764 static struct linktype_map {
 765         int     dlt;
 766         int     linktype;
 767 } map[] = {
 768         /*
 769          * These DLT_* codes have LINKTYPE_* codes with values identical
 770          * to the values of the corresponding DLT_* code.
 771          */
 772         { DLT_NULL,             LINKTYPE_NULL },
 773         { DLT_EN10MB,           LINKTYPE_ETHERNET },
 774         { DLT_EN3MB,            LINKTYPE_EXP_ETHERNET },
 775         { DLT_AX25,             LINKTYPE_AX25 },
 776         { DLT_PRONET,           LINKTYPE_PRONET },
 777         { DLT_CHAOS,            LINKTYPE_CHAOS },
 778         { DLT_IEEE802,          LINKTYPE_TOKEN_RING },
 779         { DLT_ARCNET,           LINKTYPE_ARCNET },
 780         { DLT_SLIP,             LINKTYPE_SLIP },
 781         { DLT_PPP,              LINKTYPE_PPP },
 782         { DLT_FDDI,             LINKTYPE_FDDI },
 783
 784         /*
 785          * These DLT_* codes have different values on different
 786          * platforms; we map them to LINKTYPE_* codes that
 787          * have values that should never be equal to any DLT_*
 788          * code.
 789          */
 790 #ifdef DLT_FR
 791         /* BSD/OS Frame Relay */
 792         { DLT_FR,               LINKTYPE_FRELAY },
 793 #endif
 794
 795         { DLT_SYMANTEC_FIREWALL, LINKTYPE_SYMANTEC_FIREWALL },
 796         { DLT_ATM_RFC1483,      LINKTYPE_ATM_RFC1483 },
 797         { DLT_RAW,              LINKTYPE_RAW },
 798         { DLT_SLIP_BSDOS,       LINKTYPE_SLIP_BSDOS },
 799         { DLT_PPP_BSDOS,        LINKTYPE_PPP_BSDOS },
 800
 801         /* BSD/OS Cisco HDLC */
 802         { DLT_C_HDLC,           LINKTYPE_C_HDLC },
 803
 804         /*
 805          * These DLT_* codes are not on all platforms, but, so far,
 806          * there don't appear to be any platforms that define
 807          * other codes with those values; we map them to
 808          * different LINKTYPE_* values anyway, just in case.
 809          */
 810
 811         /* Linux ATM Classical IP */
 812         { DLT_ATM_CLIP,         LINKTYPE_ATM_CLIP },
 813
 814         /* NetBSD sync/async serial PPP (or Cisco HDLC) */
 815         { DLT_PPP_SERIAL,       LINKTYPE_PPP_HDLC },
 816
 817         /* NetBSD PPP over Ethernet */
 818         { DLT_PPP_ETHER,        LINKTYPE_PPP_ETHER },
 819
 820         /* IEEE 802.11 wireless */
 821         { DLT_IEEE802_11,       LINKTYPE_IEEE802_11 },
 822
 823         /* Frame Relay */
 824         { DLT_FRELAY,           LINKTYPE_FRELAY },
 825
 826         /* OpenBSD loopback */
 827         { DLT_LOOP,             LINKTYPE_LOOP },
 828
 829         /* OpenBSD IPSEC enc */
 830         { DLT_ENC,              LINKTYPE_ENC },
 831
 832         /* Linux cooked socket capture */
 833         { DLT_LINUX_SLL,        LINKTYPE_LINUX_SLL },
 834
 835         /* Apple LocalTalk hardware */
 836         { DLT_LTALK,            LINKTYPE_LTALK },
 837
 838         /* Acorn Econet */
 839         { DLT_ECONET,           LINKTYPE_ECONET },
 840
 841         /* OpenBSD DLT_PFLOG */
 842         { DLT_PFLOG,            LINKTYPE_PFLOG },
 843
 844         /* For Cisco-internal use */
 845         { DLT_CISCO_IOS,        LINKTYPE_CISCO_IOS },
 846
 847         /* Prism II monitor-mode header plus 802.11 header */
 848         { DLT_PRISM_HEADER,     LINKTYPE_PRISM_HEADER },
 849
 850         /* FreeBSD Aironet driver stuff */
 851         { DLT_AIRONET_HEADER,   LINKTYPE_AIRONET_HEADER },
 852
 853         /* Siemens HiPath HDLC */
 854         { DLT_HHDLC,            LINKTYPE_HHDLC },
 855
 856         /* RFC 2625 IP-over-Fibre Channel */
 857         { DLT_IP_OVER_FC,       LINKTYPE_IP_OVER_FC },
 858
 859         /* Solaris+SunATM */
 860         { DLT_SUNATM,           LINKTYPE_SUNATM },
 861
 862         /* RapidIO */
 863         { DLT_RIO,              LINKTYPE_RIO },
 864
 865         /* PCI Express */
 866         { DLT_PCI_EXP,          LINKTYPE_PCI_EXP },
 867
 868         /* Xilinx Aurora link layer */
 869         { DLT_AURORA,           LINKTYPE_AURORA },
 870
 871         /* 802.11 plus BSD radio header */
 872         { DLT_IEEE802_11_RADIO, LINKTYPE_IEEE802_11_RADIO },
 873
 874         /* Tazmen Sniffer Protocol */
 875         { DLT_TZSP,             LINKTYPE_TZSP },
 876
 877         /* Arcnet with Linux-style link-layer headers */
 878         { DLT_ARCNET_LINUX,     LINKTYPE_ARCNET_LINUX },
 879
 880         /* Juniper-internal chassis encapsulation */
 881         { DLT_JUNIPER_MLPPP,    LINKTYPE_JUNIPER_MLPPP },
 882         { DLT_JUNIPER_MLFR,     LINKTYPE_JUNIPER_MLFR },
 883         { DLT_JUNIPER_ES,       LINKTYPE_JUNIPER_ES },
 884         { DLT_JUNIPER_GGSN,     LINKTYPE_JUNIPER_GGSN },
 885         { DLT_JUNIPER_MFR,      LINKTYPE_JUNIPER_MFR },
 886         { DLT_JUNIPER_ATM2,     LINKTYPE_JUNIPER_ATM2 },
 887         { DLT_JUNIPER_SERVICES, LINKTYPE_JUNIPER_SERVICES },
 888         { DLT_JUNIPER_ATM1,     LINKTYPE_JUNIPER_ATM1 },
 889
 890         /* Apple IP-over-IEEE 1394 cooked header */
 891         { DLT_APPLE_IP_OVER_IEEE1394, LINKTYPE_APPLE_IP_OVER_IEEE1394 },
 892
 893         /* SS7 */
 894         { DLT_MTP2_WITH_PHDR,   LINKTYPE_MTP2_WITH_PHDR },
 895         { DLT_MTP2,             LINKTYPE_MTP2 },
 896         { DLT_MTP3,             LINKTYPE_MTP3 },
 897         { DLT_SCCP,             LINKTYPE_SCCP },
 898
 899         /* DOCSIS MAC frames */
 900         { DLT_DOCSIS,           LINKTYPE_DOCSIS },
 901
 902         /* IrDA IrLAP packets + Linux-cooked header */
 903         { DLT_LINUX_IRDA,       LINKTYPE_LINUX_IRDA },
 904
 905         /* IBM SP and Next Federation switches */
 906         { DLT_IBM_SP,           LINKTYPE_IBM_SP },
 907         { DLT_IBM_SN,           LINKTYPE_IBM_SN },
 908
 909         /* 802.11 plus AVS radio header */
 910         { DLT_IEEE802_11_RADIO_AVS, LINKTYPE_IEEE802_11_RADIO_AVS },
 911
 912         /*
 913          * Any platform that defines additional DLT_* codes should:
 914          *
 915          *      request a LINKTYPE_* code and value from tcpdump.org,
 916          *      as per the above;
 917          *
 918          *      add, in their version of libpcap, an entry to map
 919          *      those DLT_* codes to the corresponding LINKTYPE_*
 920          *      code;
 921          *
 922          *      redefine, in their "net/bpf.h", any DLT_* values
 923          *      that collide with the values used by their additional
 924          *      DLT_* codes, to remove those collisions (but without
 925          *      making them collide with any of the LINKTYPE_*
 926          *      values equal to 50 or above; they should also avoid
 927          *      defining DLT_* values that collide with those
 928          *      LINKTYPE_* values, either).
 929          */
 930
 931         /* Juniper-internal chassis encapsulation */
 932         { DLT_JUNIPER_MONITOR,  LINKTYPE_JUNIPER_MONITOR },
 933
 934         /* BACnet MS/TP */
 935         { DLT_BACNET_MS_TP,     LINKTYPE_BACNET_MS_TP },
 936
 937         /* PPP for pppd, with direction flag in the PPP header */
 938         { DLT_PPP_PPPD,         LINKTYPE_PPP_PPPD},
 939
 940         /* Juniper-internal chassis encapsulation */
 941         { DLT_JUNIPER_PPPOE,    LINKTYPE_JUNIPER_PPPOE },
 942         { DLT_JUNIPER_PPPOE_ATM,LINKTYPE_JUNIPER_PPPOE_ATM },
 943
 944         /* GPRS LLC */
 945         { DLT_GPRS_LLC,         LINKTYPE_GPRS_LLC },
 946
 947         /* Transparent Generic Framing Procedure (ITU-T G.7041/Y.1303) */
 948         { DLT_GPF_T,            LINKTYPE_GPF_T },
 949
 950         /* Framed Generic Framing Procedure (ITU-T G.7041/Y.1303) */
 951         { DLT_GPF_F,            LINKTYPE_GPF_F },
 952
 953         { DLT_GCOM_T1E1,        LINKTYPE_GCOM_T1E1 },
 954         { DLT_GCOM_SERIAL,      LINKTYPE_GCOM_SERIAL },
 955
 956         /* Juniper-internal chassis encapsulation */
 957         { DLT_JUNIPER_PIC_PEER, LINKTYPE_JUNIPER_PIC_PEER },
 958
 959         /* Endace types */
 960         { DLT_ERF_ETH,          LINKTYPE_ERF_ETH },
 961         { DLT_ERF_POS,          LINKTYPE_ERF_POS },
 962
 963         /* viSDN LAPD */
 964         { DLT_LINUX_LAPD,       LINKTYPE_LINUX_LAPD },
 965
 966         /* Juniper meta-information before Ether, PPP, Frame Relay, C-HDLC Frames */
 967         { DLT_JUNIPER_ETHER, LINKTYPE_JUNIPER_ETHER },
 968         { DLT_JUNIPER_PPP, LINKTYPE_JUNIPER_PPP },
 969         { DLT_JUNIPER_FRELAY, LINKTYPE_JUNIPER_FRELAY },
 970         { DLT_JUNIPER_CHDLC, LINKTYPE_JUNIPER_CHDLC },
 971
 972         /* Multi Link Frame Relay (FRF.16) */
 973         { DLT_MFR,              LINKTYPE_MFR },
 974
 975         /* Juniper Voice PIC */
 976         { DLT_JUNIPER_VP,       LINKTYPE_JUNIPER_VP },
 977
 978         /* Controller Area Network (CAN) v2.0B */
 979         { DLT_A429,             LINKTYPE_A429 },
 980
 981         /* Arinc 653 Interpartition Communication messages */
 982         { DLT_A653_ICM,         LINKTYPE_A653_ICM },
 983
 984         /* USB */
 985         { DLT_USB,              LINKTYPE_USB },
 986
 987         /* Bluetooth HCI UART transport layer */
 988         { DLT_BLUETOOTH_HCI_H4, LINKTYPE_BLUETOOTH_HCI_H4 },
 989
 990         /* IEEE 802.16 MAC Common Part Sublayer */
 991         { DLT_IEEE802_16_MAC_CPS,       LINKTYPE_IEEE802_16_MAC_CPS },
 992
 993         /* USB with Linux header */
 994         { DLT_USB_LINUX,        LINKTYPE_USB_LINUX },
 995
 996         /* Controller Area Network (CAN) v2.0B */
 997         { DLT_CAN20B,           LINKTYPE_CAN20B },
 998
 999         /* IEEE 802.15.4 with address fields padded */
1000         { DLT_IEEE802_15_4_LINUX,       LINKTYPE_IEEE802_15_4_LINUX },
1001
1002         /* Per Packet Information encapsulated packets */
1003         { DLT_PPI,                      LINKTYPE_PPI },
1004
1005         /* IEEE 802.16 MAC Common Part Sublayer plus radiotap header */
1006         { DLT_IEEE802_16_MAC_CPS_RADIO, LINKTYPE_IEEE802_16_MAC_CPS_RADIO },
1007
1008         /* Juniper Voice ISM */
1009         { DLT_JUNIPER_ISM,      LINKTYPE_JUNIPER_ISM },
1010
1011         /* IEEE 802.15.4 exactly as it appears in the spec, with FCS */
1012         { DLT_IEEE802_15_4,     LINKTYPE_IEEE802_15_4 },
1013
1014         /* Various link-layer types for SITA */
1015         { DLT_SITA,             LINKTYPE_SITA },
1016
1017         /* Various link-layer types for Endace */
1018         { DLT_ERF,              LINKTYPE_ERF },
1019
1020         /* Special header for u10 Networks boards */
1021         { DLT_RAIF1,            LINKTYPE_RAIF1 },
1022
1023         /* IPMB */
1024         { DLT_IPMB,             LINKTYPE_IPMB },
1025
1026         /* Juniper Secure Tunnel */
1027         { DLT_JUNIPER_ST,       LINKTYPE_JUNIPER_ST },
1028
1029         /* Bluetooth HCI UART transport layer, with pseudo-header */
1030         { DLT_BLUETOOTH_HCI_H4_WITH_PHDR, LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR },
1031
1032         /* AX.25 with KISS header */
1033         { DLT_AX25_KISS,        LINKTYPE_AX25_KISS },
1034
1035         /* Raw LAPD, with no pseudo-header */
1036         { DLT_LAPD,             LINKTYPE_LAPD },
1037
1038         /* PPP with one-byte pseudo-header giving direction */
1039         { DLT_PPP_WITH_DIR,     LINKTYPE_PPP_WITH_DIR },
1040
1041         /* Cisco HDLC with one-byte pseudo-header giving direction */
1042         { DLT_C_HDLC_WITH_DIR,  LINKTYPE_C_HDLC_WITH_DIR },
1043
1044         /* Frame Relay with one-byte pseudo-header giving direction */
1045         { DLT_FRELAY_WITH_DIR,  LINKTYPE_FRELAY_WITH_DIR },
1046
1047         /* LAPB with one-byte pseudo-header giving direction */
1048         { DLT_LAPB_WITH_DIR,    LINKTYPE_LAPB_WITH_DIR },
1049
1050         /* IPMB with Linux pseudo-header */
1051         { DLT_IPMB_LINUX,       LINKTYPE_IPMB_LINUX },
1052
1053         /* FlexRay */
1054         { DLT_FLEXRAY,          LINKTYPE_FLEXRAY },
1055
1056         /* MOST */
1057         { DLT_MOST,             LINKTYPE_MOST },
1058
1059         /* LIN */
1060         { DLT_LIN,              LINKTYPE_LIN },
1061
1062         /* X2E-private serial line capture */
1063         { DLT_X2E_SERIAL,       LINKTYPE_X2E_SERIAL },
1064
1065         /* X2E-private for Xoraya data logger family */
1066         { DLT_X2E_XORAYA,       LINKTYPE_X2E_XORAYA },
1067
1068         /* IEEE 802.15.4 with PHY data for non-ASK PHYs */
1069         { DLT_IEEE802_15_4_NONASK_PHY, LINKTYPE_IEEE802_15_4_NONASK_PHY },
1070
1071         /* Input device events from Linux /dev/input/eventN devices */
1072         { DLT_LINUX_EVDEV,      LINKTYPE_LINUX_EVDEV },
1073
1074         /* GSM types */
1075         { DLT_GSMTAP_UM,        LINKTYPE_GSMTAP_UM },
1076         { DLT_GSMTAP_ABIS,      LINKTYPE_GSMTAP_ABIS },
1077
1078         /* MPLS, with an MPLS label as the link-layer header */
1079         { DLT_MPLS,             LINKTYPE_MPLS },
1080
1081         /* USB with padded Linux header */
1082         { DLT_USB_LINUX_MMAPPED, LINKTYPE_USB_LINUX_MMAPPED },
1083
1084         /* DECT packets with a pseudo-header */
1085         { DLT_DECT,             LINKTYPE_DECT },
1086
1087         /* AOS Space Data Link Protocol */
1088         { DLT_AOS,              LINKTYPE_AOS },
1089
1090         /* Wireless HART */
1091         { DLT_WIHART,           LINKTYPE_WIHART },
1092
1093         /* Fibre Channel FC-2 frames without SOF or EOF */
1094         { DLT_FC_2,             LINKTYPE_FC_2 },
1095
1096         /* Fibre Channel FC-2 frames with SOF and EOF */
1097         { DLT_FC_2_WITH_FRAME_DELIMS, LINKTYPE_FC_2_WITH_FRAME_DELIMS },
1098
1099         /* Solaris IPNET */
1100         { DLT_IPNET,            LINKTYPE_IPNET },
1101
1102         /* CAN frames with SocketCAN headers */
1103         { DLT_CAN_SOCKETCAN,    LINKTYPE_CAN_SOCKETCAN },
1104
1105         /* Raw IPv4/IPv6 */
1106         { DLT_IPV4,             LINKTYPE_IPV4 },
1107         { DLT_IPV6,             LINKTYPE_IPV6 },
1108
1109         /* IEEE 802.15.4 exactly as it appears in the spec, without FCS */
1110         { DLT_IEEE802_15_4_NOFCS, LINKTYPE_IEEE802_15_4_NOFCS },
1111
1112         /* D-Bus messages */
1113         { DLT_DBUS,             LINKTYPE_DBUS },
1114
1115         /* Juniper Virtual Server */
1116         { DLT_JUNIPER_VS,       LINKTYPE_JUNIPER_VS },
1117
1118         /* Juniper SRX E2E debugging */
1119         { DLT_JUNIPER_SRX_E2E,  LINKTYPE_JUNIPER_SRX_E2E },
1120
1121         /* Juniper Fibrechannel */
1122         { DLT_JUNIPER_FIBRECHANNEL, LINKTYPE_JUNIPER_FIBRECHANNEL },
1123
1124         { -1,                   -1 }
1125 };
1126
1127 int
1128 dlt_to_linktype(int dlt)
1129 {
1130         int i;
1131
1132         for (i = 0; map[i].dlt != -1; i++) {
1133                 if (map[i].dlt == dlt)
1134                         return (map[i].linktype);
1135         }
1136
1137         /*
1138          * If we don't have a mapping for this DLT_ code, return an
1139          * error; that means that the table above needs to have an
1140          * entry added.
1141          */
1142         return (-1);
1143 }
1144
1145 int
1146 linktype_to_dlt(int linktype)
1147 {
1148         int i;
1149
1150         for (i = 0; map[i].linktype != -1; i++) {
1151                 if (map[i].linktype == linktype)
1152                         return (map[i].dlt);
1153         }
1154
1155         /*
1156          * If we don't have an entry for this link type, return
1157          * the link type value; it may be a DLT_ value from an
1158          * older version of libpcap.
1159          */
1160         return linktype;
1161 }
1162
1163 /*
1164  * The DLT_USB_LINUX and DLT_USB_LINUX_MMAPPED headers are in host
1165  * byte order when capturing (it's supplied directly from a
1166  * memory-mapped buffer shared by the kernel).
1167  *
1168  * When reading a DLT_USB_LINUX or DLT_USB_LINUX_MMAPPED capture file,
1169  * we need to convert it from the capturing host's byte order to
1170  * the reading host's byte order.
1171  */
1172 void
1173 swap_linux_usb_header(const struct pcap_pkthdr *hdr, u_char *buf,
1174     int header_len_64_bytes)
1175 {
1176         pcap_usb_header_mmapped *uhdr = (pcap_usb_header_mmapped *)buf;
1177
1178         /*
1179          * The URB id is a totally opaque value; do we really need to
1180          * convert it to the reading host's byte order???
1181          */
1182         if (hdr->caplen < 8)
1183                 return;
1184         uhdr->id = SWAPLL(uhdr->id);
1185         if (hdr->caplen < 14)
1186                 return;
1187         uhdr->bus_id = SWAPSHORT(uhdr->bus_id);
1188         if (hdr->caplen < 24)
1189                 return;
1190         uhdr->ts_sec = SWAPLL(uhdr->ts_sec);
1191         if (hdr->caplen < 28)
1192                 return;
1193         uhdr->ts_usec = SWAPLONG(uhdr->ts_usec);
1194         if (hdr->caplen < 32)
1195                 return;
1196         uhdr->status = SWAPLONG(uhdr->status);
1197         if (hdr->caplen < 36)
1198                 return;
1199         uhdr->urb_len = SWAPLONG(uhdr->urb_len);
1200         if (hdr->caplen < 40)
1201                 return;
1202         uhdr->data_len = SWAPLONG(uhdr->data_len);
1203
1204         if (header_len_64_bytes) {
1205                 /*
1206                  * This is either the "version 1" header, with
1207                  * 16 bytes of additional fields at the end, or
1208                  * a "version 0" header from a memory-mapped
1209                  * capture, with 16 bytes of zeroed-out padding
1210                  * at the end.  Byte swap them as if this were
1211                  * a "version 1" header.
1212                  */
1213                 if (hdr->caplen < 52)
1214                         return;
1215                 uhdr->interval = SWAPLONG(uhdr->interval);
1216                 if (hdr->caplen < 56)
1217                         return;
1218                 uhdr->start_frame = SWAPLONG(uhdr->start_frame);
1219                 if (hdr->caplen < 60)
1220                         return;
1221                 uhdr->xfer_flags = SWAPLONG(uhdr->xfer_flags);
1222                 if (hdr->caplen < 64)
1223                         return;
1224                 uhdr->ndesc = SWAPLONG(uhdr->ndesc);
1225         }
1226 }