]> The Tcpdump Group git mirrors - libpcap/blob - pcap-common.c
projects / libpcap / blob


9af2aaab5ee6c0c17a7dba6ac82cd3d93d710a82
[libpcap] / pcap-common.c
1 /*
2 * Copyright (c) 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 * pcap-common.c - common code for pcap and pcap-ng files
22 */
23
24 #ifdef HAVE_CONFIG_H
25 #include "config.h"
26 #endif
27
28 #ifdef WIN32
29 #include <pcap-stdinc.h>
30 #else /* WIN32 */
31 #if HAVE_INTTYPES_H
32 #include <inttypes.h>
33 #elif HAVE_STDINT_H
34 #include <stdint.h>
35 #endif
36 #ifdef HAVE_SYS_BITYPES_H
37 #include <sys/bitypes.h>
38 #endif
39 #include <sys/types.h>
40 #endif /* WIN32 */
41
42 #include "pcap-int.h"
43 #include "pcap/usb.h"
44
45 #include "pcap-common.h"
46
47 /*
48 * We don't write DLT_* values to capture files, because they're not the
49 * same on all platforms.
50 *
51 * Unfortunately, the various flavors of BSD have not always used the same
52 * numerical values for the same data types, and various patches to
53 * libpcap for non-BSD OSes have added their own DLT_* codes for link
54 * layer encapsulation types seen on those OSes, and those codes have had,
55 * in some cases, values that were also used, on other platforms, for other
56 * link layer encapsulation types.
57 *
58 * This means that capture files of a type whose numerical DLT_* code
59 * means different things on different BSDs, or with different versions
60 * of libpcap, can't always be read on systems other than those like
61 * the one running on the machine on which the capture was made.
62 *
63 * Instead, we define here a set of LINKTYPE_* codes, and map DLT_* codes
64 * to LINKTYPE_* codes when writing a savefile header, and map LINKTYPE_*
65 * codes to DLT_* codes when reading a savefile header.
66 *
67 * For those DLT_* codes that have, as far as we know, the same values on
68 * all platforms (DLT_NULL through DLT_FDDI), we define LINKTYPE_xxx as
69 * DLT_xxx; that way, captures of those types can still be read by
70 * versions of libpcap that map LINKTYPE_* values to DLT_* values, and
71 * captures of those types written by versions of libpcap that map DLT_
72 * values to LINKTYPE_ values can still be read by older versions
73 * of libpcap.
74 *
75 * The other LINKTYPE_* codes are given values starting at 100, in the
76 * hopes that no DLT_* code will be given one of those values.
77 *
78 * In order to ensure that a given LINKTYPE_* code's value will refer to
79 * the same encapsulation type on all platforms, you should not allocate
80 * a new LINKTYPE_* value without consulting
81 * "tcpdump-workers@lists.tcpdump.org". The tcpdump developers will
82 * allocate a value for you, and will not subsequently allocate it to
83 * anybody else; that value will be added to the "pcap.h" in the
84 * tcpdump.org Git repository, so that a future libpcap release will
85 * include it.
86 *
87 * You should, if possible, also contribute patches to libpcap and tcpdump
88 * to handle the new encapsulation type, so that they can also be checked
89 * into the tcpdump.org Git repository and so that they will appear in
90 * future libpcap and tcpdump releases.
91 *
92 * Do *NOT* assume that any values after the largest value in this file
93 * are available; you might not have the most up-to-date version of this
94 * file, and new values after that one might have been assigned. Also,
95 * do *NOT* use any values below 100 - those might already have been
96 * taken by one (or more!) organizations.
97 */
98 #define LINKTYPE_NULL DLT_NULL
99 #define LINKTYPE_ETHERNET DLT_EN10MB /* also for 100Mb and up */
100 #define LINKTYPE_EXP_ETHERNET DLT_EN3MB /* 3Mb experimental Ethernet */
101 #define LINKTYPE_AX25 DLT_AX25
102 #define LINKTYPE_PRONET DLT_PRONET
103 #define LINKTYPE_CHAOS DLT_CHAOS
104 #define LINKTYPE_TOKEN_RING DLT_IEEE802 /* DLT_IEEE802 is used for Token Ring */
105 #define LINKTYPE_ARCNET_BSD DLT_ARCNET /* BSD-style headers */
106 #define LINKTYPE_SLIP DLT_SLIP
107 #define LINKTYPE_PPP DLT_PPP
108 #define LINKTYPE_FDDI DLT_FDDI
109
110 /*
111 * LINKTYPE_PPP is for use when there might, or might not, be an RFC 1662
112 * PPP in HDLC-like framing header (with 0xff 0x03 before the PPP protocol
113 * field) at the beginning of the packet.
114 *
115 * This is for use when there is always such a header; the address field
116 * might be 0xff, for regular PPP, or it might be an address field for Cisco
117 * point-to-point with HDLC framing as per section 4.3.1 of RFC 1547 ("Cisco
118 * HDLC"). This is, for example, what you get with NetBSD's DLT_PPP_SERIAL.
119 *
120 * We give it the same value as NetBSD's DLT_PPP_SERIAL, in the hopes that
121 * nobody else will choose a DLT_ value of 50, and so that DLT_PPP_SERIAL
122 * captures will be written out with a link type that NetBSD's tcpdump
123 * can read.
124 */
125 #define LINKTYPE_PPP_HDLC 50 /* PPP in HDLC-like framing */
126
127 #define LINKTYPE_PPP_ETHER 51 /* NetBSD PPP-over-Ethernet */
128
129 #define LINKTYPE_SYMANTEC_FIREWALL 99 /* Symantec Enterprise Firewall */
130
131 #define LINKTYPE_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */
132 #define LINKTYPE_RAW 101 /* raw IP */
133 #define LINKTYPE_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */
134 #define LINKTYPE_PPP_BSDOS 103 /* BSD/OS PPP BPF header */
135 #define LINKTYPE_C_HDLC 104 /* Cisco HDLC */
136 #define LINKTYPE_IEEE802_11 105 /* IEEE 802.11 (wireless) */
137 #define LINKTYPE_ATM_CLIP 106 /* Linux Classical IP over ATM */
138 #define LINKTYPE_FRELAY 107 /* Frame Relay */
139 #define LINKTYPE_LOOP 108 /* OpenBSD loopback */
140 #define LINKTYPE_ENC 109 /* OpenBSD IPSEC enc */
141
142 /*
143 * These three types are reserved for future use.
144 */
145 #define LINKTYPE_LANE8023 110 /* ATM LANE + 802.3 */
146 #define LINKTYPE_HIPPI 111 /* NetBSD HIPPI */
147 #define LINKTYPE_HDLC 112 /* NetBSD HDLC framing */
148
149 #define LINKTYPE_LINUX_SLL 113 /* Linux cooked socket capture */
150 #define LINKTYPE_LTALK 114 /* Apple LocalTalk hardware */
151 #define LINKTYPE_ECONET 115 /* Acorn Econet */
152
153 /*
154 * Reserved for use with OpenBSD ipfilter.
155 */
156 #define LINKTYPE_IPFILTER 116
157
158 #define LINKTYPE_PFLOG 117 /* OpenBSD DLT_PFLOG */
159 #define LINKTYPE_CISCO_IOS 118 /* For Cisco-internal use */
160 #define LINKTYPE_PRISM_HEADER 119 /* 802.11+Prism II monitor mode */
161 #define LINKTYPE_AIRONET_HEADER 120 /* FreeBSD Aironet driver stuff */
162
163 /*
164 * Reserved for Siemens HiPath HDLC.
165 */
166 #define LINKTYPE_HHDLC 121
167
168 #define LINKTYPE_IP_OVER_FC 122 /* RFC 2625 IP-over-Fibre Channel */
169 #define LINKTYPE_SUNATM 123 /* Solaris+SunATM */
170
171 /*
172 * Reserved as per request from Kent Dahlgren <kent@praesum.com>
173 * for private use.
174 */
175 #define LINKTYPE_RIO 124 /* RapidIO */
176 #define LINKTYPE_PCI_EXP 125 /* PCI Express */
177 #define LINKTYPE_AURORA 126 /* Xilinx Aurora link layer */
178
179 #define LINKTYPE_IEEE802_11_RADIO 127 /* 802.11 plus BSD radio header */
180
181 /*
182 * Reserved for the TZSP encapsulation, as per request from
183 * Chris Waters <chris.waters@networkchemistry.com>
184 * TZSP is a generic encapsulation for any other link type,
185 * which includes a means to include meta-information
186 * with the packet, e.g. signal strength and channel
187 * for 802.11 packets.
188 */
189 #define LINKTYPE_TZSP 128 /* Tazmen Sniffer Protocol */
190
191 #define LINKTYPE_ARCNET_LINUX 129 /* Linux-style headers */
192
193 /*
194 * Juniper-private data link types, as per request from
195 * Hannes Gredler <hannes@juniper.net>. The corresponding
196 * DLT_s are used for passing on chassis-internal
197 * metainformation such as QOS profiles, etc..
198 */
199 #define LINKTYPE_JUNIPER_MLPPP 130
200 #define LINKTYPE_JUNIPER_MLFR 131
201 #define LINKTYPE_JUNIPER_ES 132
202 #define LINKTYPE_JUNIPER_GGSN 133
203 #define LINKTYPE_JUNIPER_MFR 134
204 #define LINKTYPE_JUNIPER_ATM2 135
205 #define LINKTYPE_JUNIPER_SERVICES 136
206 #define LINKTYPE_JUNIPER_ATM1 137
207
208 #define LINKTYPE_APPLE_IP_OVER_IEEE1394 138 /* Apple IP-over-IEEE 1394 cooked header */
209
210 #define LINKTYPE_MTP2_WITH_PHDR 139
211 #define LINKTYPE_MTP2 140
212 #define LINKTYPE_MTP3 141
213 #define LINKTYPE_SCCP 142
214
215 #define LINKTYPE_DOCSIS 143 /* DOCSIS MAC frames */
216
217 #define LINKTYPE_LINUX_IRDA 144 /* Linux-IrDA */
218
219 /*
220 * Reserved for IBM SP switch and IBM Next Federation switch.
221 */
222 #define LINKTYPE_IBM_SP 145
223 #define LINKTYPE_IBM_SN 146
224
225 /*
226 * Reserved for private use. If you have some link-layer header type
227 * that you want to use within your organization, with the capture files
228 * using that link-layer header type not ever be sent outside your
229 * organization, you can use these values.
230 *
231 * No libpcap release will use these for any purpose, nor will any
232 * tcpdump release use them, either.
233 *
234 * Do *NOT* use these in capture files that you expect anybody not using
235 * your private versions of capture-file-reading tools to read; in
236 * particular, do *NOT* use them in products, otherwise you may find that
237 * people won't be able to use tcpdump, or snort, or Ethereal, or... to
238 * read capture files from your firewall/intrusion detection/traffic
239 * monitoring/etc. appliance, or whatever product uses that LINKTYPE_ value,
240 * and you may also find that the developers of those applications will
241 * not accept patches to let them read those files.
242 *
243 * Also, do not use them if somebody might send you a capture using them
244 * for *their* private type and tools using them for *your* private type
245 * would have to read them.
246 *
247 * Instead, in those cases, ask "tcpdump-workers@lists.tcpdump.org" for a
248 * new DLT_ and LINKTYPE_ value, as per the comment in pcap/bpf.h, and use
249 * the type you're given.
250 */
251 #define LINKTYPE_USER0 147
252 #define LINKTYPE_USER1 148
253 #define LINKTYPE_USER2 149
254 #define LINKTYPE_USER3 150
255 #define LINKTYPE_USER4 151
256 #define LINKTYPE_USER5 152
257 #define LINKTYPE_USER6 153
258 #define LINKTYPE_USER7 154
259 #define LINKTYPE_USER8 155
260 #define LINKTYPE_USER9 156
261 #define LINKTYPE_USER10 157
262 #define LINKTYPE_USER11 158
263 #define LINKTYPE_USER12 159
264 #define LINKTYPE_USER13 160
265 #define LINKTYPE_USER14 161
266 #define LINKTYPE_USER15 162
267
268 /*
269 * For future use with 802.11 captures - defined by AbsoluteValue
270 * Systems to store a number of bits of link-layer information
271 * including radio information:
272 *
273 * http://www.shaftnet.org/~pizza/software/capturefrm.txt
274 *
275 * but could and arguably should also be used by non-AVS Linux
276 * 802.11 drivers; that may happen in the future.
277 */
278 #define LINKTYPE_IEEE802_11_RADIO_AVS 163 /* 802.11 plus AVS radio header */
279
280 /*
281 * Juniper-private data link type, as per request from
282 * Hannes Gredler <hannes@juniper.net>. The corresponding
283 * DLT_s are used for passing on chassis-internal
284 * metainformation such as QOS profiles, etc..
285 */
286 #define LINKTYPE_JUNIPER_MONITOR 164
287
288 /*
289 * Reserved for BACnet MS/TP.
290 */
291 #define LINKTYPE_BACNET_MS_TP 165
292
293 /*
294 * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>.
295 *
296 * This is used in some OSes to allow a kernel socket filter to distinguish
297 * between incoming and outgoing packets, on a socket intended to
298 * supply pppd with outgoing packets so it can do dial-on-demand and
299 * hangup-on-lack-of-demand; incoming packets are filtered out so they
300 * don't cause pppd to hold the connection up (you don't want random
301 * input packets such as port scans, packets from old lost connections,
302 * etc. to force the connection to stay up).
303 *
304 * The first byte of the PPP header (0xff03) is modified to accomodate
305 * the direction - 0x00 = IN, 0x01 = OUT.
306 */
307 #define LINKTYPE_PPP_PPPD 166
308
309 /*
310 * Juniper-private data link type, as per request from
311 * Hannes Gredler <hannes@juniper.net>. The DLT_s are used
312 * for passing on chassis-internal metainformation such as
313 * QOS profiles, cookies, etc..
314 */
315 #define LINKTYPE_JUNIPER_PPPOE 167
316 #define LINKTYPE_JUNIPER_PPPOE_ATM 168
317
318 #define LINKTYPE_GPRS_LLC 169 /* GPRS LLC */
319 #define LINKTYPE_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */
320 #define LINKTYPE_GPF_F 171 /* GPF-T (ITU-T G.7041/Y.1303) */
321
322 /*
323 * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line
324 * monitoring equipment.
325 */
326 #define LINKTYPE_GCOM_T1E1 172
327 #define LINKTYPE_GCOM_SERIAL 173
328
329 /*
330 * Juniper-private data link type, as per request from
331 * Hannes Gredler <hannes@juniper.net>. The DLT_ is used
332 * for internal communication to Physical Interface Cards (PIC)
333 */
334 #define LINKTYPE_JUNIPER_PIC_PEER 174
335
336 /*
337 * Link types requested by Gregor Maier <gregor@endace.com> of Endace
338 * Measurement Systems. They add an ERF header (see
339 * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of
340 * the link-layer header.
341 */
342 #define LINKTYPE_ERF_ETH 175 /* Ethernet */
343 #define LINKTYPE_ERF_POS 176 /* Packet-over-SONET */
344
345 /*
346 * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD
347 * for vISDN (http://www.orlandi.com/visdn/). Its link-layer header
348 * includes additional information before the LAPD header, so it's
349 * not necessarily a generic LAPD header.
350 */
351 #define LINKTYPE_LINUX_LAPD 177
352
353 /*
354 * Juniper-private data link type, as per request from
355 * Hannes Gredler <hannes@juniper.net>.
356 * The Link Types are used for prepending meta-information
357 * like interface index, interface name
358 * before standard Ethernet, PPP, Frelay & C-HDLC Frames
359 */
360 #define LINKTYPE_JUNIPER_ETHER 178
361 #define LINKTYPE_JUNIPER_PPP 179
362 #define LINKTYPE_JUNIPER_FRELAY 180
363 #define LINKTYPE_JUNIPER_CHDLC 181
364
365 /*
366 * Multi Link Frame Relay (FRF.16)
367 */
368 #define LINKTYPE_MFR 182
369
370 /*
371 * Juniper-private data link type, as per request from
372 * Hannes Gredler <hannes@juniper.net>.
373 * The DLT_ is used for internal communication with a
374 * voice Adapter Card (PIC)
375 */
376 #define LINKTYPE_JUNIPER_VP 183
377
378 /*
379 * Arinc 429 frames.
380 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
381 * Every frame contains a 32bit A429 label.
382 * More documentation on Arinc 429 can be found at
383 * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
384 */
385 #define LINKTYPE_A429 184
386
387 /*
388 * Arinc 653 Interpartition Communication messages.
389 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
390 * Please refer to the A653-1 standard for more information.
391 */
392 #define LINKTYPE_A653_ICM 185
393
394 /*
395 * USB packets, beginning with a USB setup header; requested by
396 * Paolo Abeni <paolo.abeni@email.it>.
397 */
398 #define LINKTYPE_USB 186
399
400 /*
401 * Bluetooth HCI UART transport layer (part H:4); requested by
402 * Paolo Abeni.
403 */
404 #define LINKTYPE_BLUETOOTH_HCI_H4 187
405
406 /*
407 * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
408 * <cruz_petagay@bah.com>.
409 */
410 #define LINKTYPE_IEEE802_16_MAC_CPS 188
411
412 /*
413 * USB packets, beginning with a Linux USB header; requested by
414 * Paolo Abeni <paolo.abeni@email.it>.
415 */
416 #define LINKTYPE_USB_LINUX 189
417
418 /*
419 * Controller Area Network (CAN) v. 2.0B packets.
420 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
421 * Used to dump CAN packets coming from a CAN Vector board.
422 * More documentation on the CAN v2.0B frames can be found at
423 * http://www.can-cia.org/downloads/?269
424 */
425 #define LINKTYPE_CAN20B 190
426
427 /*
428 * IEEE 802.15.4, with address fields padded, as is done by Linux
429 * drivers; requested by Juergen Schimmer.
430 */
431 #define LINKTYPE_IEEE802_15_4_LINUX 191
432
433 /*
434 * Per Packet Information encapsulated packets.
435 * LINKTYPE_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
436 */
437 #define LINKTYPE_PPI 192
438
439 /*
440 * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
441 * requested by Charles Clancy.
442 */
443 #define LINKTYPE_IEEE802_16_MAC_CPS_RADIO 193
444
445 /*
446 * Juniper-private data link type, as per request from
447 * Hannes Gredler <hannes@juniper.net>.
448 * The DLT_ is used for internal communication with a
449 * integrated service module (ISM).
450 */
451 #define LINKTYPE_JUNIPER_ISM 194
452
453 /*
454 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
455 * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.
456 */
457 #define LINKTYPE_IEEE802_15_4 195
458
459 /*
460 * Various link-layer types, with a pseudo-header, for SITA
461 * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).
462 */
463 #define LINKTYPE_SITA 196
464
465 /*
466 * Various link-layer types, with a pseudo-header, for Endace DAG cards;
467 * encapsulates Endace ERF records. Requested by Stephen Donnelly
468 * <stephen@endace.com>.
469 */
470 #define LINKTYPE_ERF 197
471
472 /*
473 * Special header prepended to Ethernet packets when capturing from a
474 * u10 Networks board. Requested by Phil Mulholland
475 * <phil@u10networks.com>.
476 */
477 #define LINKTYPE_RAIF1 198
478
479 /*
480 * IPMB packet for IPMI, beginning with the I2C slave address, followed
481 * by the netFn and LUN, etc.. Requested by Chanthy Toeung
482 * <chanthy.toeung@ca.kontron.com>.
483 */
484 #define LINKTYPE_IPMB 199
485
486 /*
487 * Juniper-private data link type, as per request from
488 * Hannes Gredler <hannes@juniper.net>.
489 * The DLT_ is used for capturing data on a secure tunnel interface.
490 */
491 #define LINKTYPE_JUNIPER_ST 200
492
493 /*
494 * Bluetooth HCI UART transport layer (part H:4), with pseudo-header
495 * that includes direction information; requested by Paolo Abeni.
496 */
497 #define LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR 201
498
499 /*
500 * AX.25 packet with a 1-byte KISS header; see
501 *
502 * http://www.ax25.net/kiss.htm
503 *
504 * as per Richard Stearn <richard@rns-stearn.demon.co.uk>.
505 */
506 #define LINKTYPE_AX25_KISS 202
507
508 /*
509 * LAPD packets from an ISDN channel, starting with the address field,
510 * with no pseudo-header.
511 * Requested by Varuna De Silva <varunax@gmail.com>.
512 */
513 #define LINKTYPE_LAPD 203
514
515 /*
516 * Variants of various link-layer headers, with a one-byte direction
517 * pseudo-header prepended - zero means "received by this host",
518 * non-zero (any non-zero value) means "sent by this host" - as per
519 * Will Barker <w.barker@zen.co.uk>.
520 */
521 #define LINKTYPE_PPP_WITH_DIR 204 /* PPP */
522 #define LINKTYPE_C_HDLC_WITH_DIR 205 /* Cisco HDLC */
523 #define LINKTYPE_FRELAY_WITH_DIR 206 /* Frame Relay */
524 #define LINKTYPE_LAPB_WITH_DIR 207 /* LAPB */
525
526 /*
527 * 208 is reserved for an as-yet-unspecified proprietary link-layer
528 * type, as requested by Will Barker.
529 */
530
531 /*
532 * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman
533 * <avn@pigeonpoint.com>.
534 */
535 #define LINKTYPE_IPMB_LINUX 209
536
537 /*
538 * FlexRay automotive bus - http://www.flexray.com/ - as requested
539 * by Hannes Kaelber <hannes.kaelber@x2e.de>.
540 */
541 #define LINKTYPE_FLEXRAY 210
542
543 /*
544 * Media Oriented Systems Transport (MOST) bus for multimedia
545 * transport - http://www.mostcooperation.com/ - as requested
546 * by Hannes Kaelber <hannes.kaelber@x2e.de>.
547 */
548 #define LINKTYPE_MOST 211
549
550 /*
551 * Local Interconnect Network (LIN) bus for vehicle networks -
552 * http://www.lin-subbus.org/ - as requested by Hannes Kaelber
553 * <hannes.kaelber@x2e.de>.
554 */
555 #define LINKTYPE_LIN 212
556
557 /*
558 * X2E-private data link type used for serial line capture,
559 * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
560 */
561 #define LINKTYPE_X2E_SERIAL 213
562
563 /*
564 * X2E-private data link type used for the Xoraya data logger
565 * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
566 */
567 #define LINKTYPE_X2E_XORAYA 214
568
569 /*
570 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
571 * nothing), but with the PHY-level data for non-ASK PHYs (4 octets
572 * of 0 as preamble, one octet of SFD, one octet of frame length+
573 * reserved bit, and then the MAC-layer data, starting with the
574 * frame control field).
575 *
576 * Requested by Max Filippov <jcmvbkbc@gmail.com>.
577 */
578 #define LINKTYPE_IEEE802_15_4_NONASK_PHY 215
579
580 /*
581 * David Gibson <david@gibson.dropbear.id.au> requested this for
582 * captures from the Linux kernel /dev/input/eventN devices. This
583 * is used to communicate keystrokes and mouse movements from the
584 * Linux kernel to display systems, such as Xorg.
585 */
586 #define LINKTYPE_LINUX_EVDEV 216
587
588 /*
589 * GSM Um and Abis interfaces, preceded by a "gsmtap" header.
590 *
591 * Requested by Harald Welte <laforge@gnumonks.org>.
592 */
593 #define LINKTYPE_GSMTAP_UM 217
594 #define LINKTYPE_GSMTAP_ABIS 218
595
596 /*
597 * MPLS, with an MPLS label as the link-layer header.
598 * Requested by Michele Marchetto <michele@openbsd.org> on behalf
599 * of OpenBSD.
600 */
601 #define LINKTYPE_MPLS 219
602
603 /*
604 * USB packets, beginning with a Linux USB header, with the USB header
605 * padded to 64 bytes; required for memory-mapped access.
606 */
607 #define LINKTYPE_USB_LINUX_MMAPPED 220
608
609 /*
610 * DECT packets, with a pseudo-header; requested by
611 * Matthias Wenzel <tcpdump@mazzoo.de>.
612 */
613 #define LINKTYPE_DECT 221
614
615 /*
616 * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov>
617 * Date: Mon, 11 May 2009 11:18:30 -0500
618 *
619 * DLT_AOS. We need it for AOS Space Data Link Protocol.
620 * I have already written dissectors for but need an OK from
621 * legal before I can submit a patch.
622 *
623 */
624 #define LINKTYPE_AOS 222
625
626 /*
627 * Wireless HART (Highway Addressable Remote Transducer)
628 * From the HART Communication Foundation
629 * IES/PAS 62591
630 *
631 * Requested by Sam Roberts <vieuxtech@gmail.com>.
632 */
633 #define LINKTYPE_WIHART 223
634
635 /*
636 * Fibre Channel FC-2 frames, beginning with a Frame_Header.
637 * Requested by Kahou Lei <kahou82@gmail.com>.
638 */
639 #define LINKTYPE_FC_2 224
640
641 /*
642 * Fibre Channel FC-2 frames, beginning with an encoding of the
643 * SOF, and ending with an encoding of the EOF.
644 *
645 * The encodings represent the frame delimiters as 4-byte sequences
646 * representing the corresponding ordered sets, with K28.5
647 * represented as 0xBC, and the D symbols as the corresponding
648 * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2,
649 * is represented as 0xBC 0xB5 0x55 0x55.
650 *
651 * Requested by Kahou Lei <kahou82@gmail.com>.
652 */
653 #define LINKTYPE_FC_2_WITH_FRAME_DELIMS 225
654
655 /*
656 * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>.
657 *
658 * The pseudo-header starts with a one-byte version number; for version 2,
659 * the pseudo-header is:
660 *
661 * struct dl_ipnetinfo {
662 * u_int8_t dli_version;
663 * u_int8_t dli_family;
664 * u_int16_t dli_htype;
665 * u_int32_t dli_pktlen;
666 * u_int32_t dli_ifindex;
667 * u_int32_t dli_grifindex;
668 * u_int32_t dli_zsrc;
669 * u_int32_t dli_zdst;
670 * };
671 *
672 * dli_version is 2 for the current version of the pseudo-header.
673 *
674 * dli_family is a Solaris address family value, so it's 2 for IPv4
675 * and 26 for IPv6.
676 *
677 * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing
678 * packets, and 2 for packets arriving from another zone on the same
679 * machine.
680 *
681 * dli_pktlen is the length of the packet data following the pseudo-header
682 * (so the captured length minus dli_pktlen is the length of the
683 * pseudo-header, assuming the entire pseudo-header was captured).
684 *
685 * dli_ifindex is the interface index of the interface on which the
686 * packet arrived.
687 *
688 * dli_grifindex is the group interface index number (for IPMP interfaces).
689 *
690 * dli_zsrc is the zone identifier for the source of the packet.
691 *
692 * dli_zdst is the zone identifier for the destination of the packet.
693 *
694 * A zone number of 0 is the global zone; a zone number of 0xffffffff
695 * means that the packet arrived from another host on the network, not
696 * from another zone on the same machine.
697 *
698 * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates
699 * which of those it is.
700 */
701 #define LINKTYPE_IPNET 226
702
703 /*
704 * CAN (Controller Area Network) frames, with a pseudo-header as supplied
705 * by Linux SocketCAN. See Documentation/networking/can.txt in the Linux
706 * source.
707 *
708 * Requested by Felix Obenhuber <felix@obenhuber.de>.
709 */
710 #define LINKTYPE_CAN_SOCKETCAN 227
711
712 /*
713 * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies
714 * whether it's v4 or v6. Requested by Darren Reed <Darren.Reed@Sun.COM>.
715 */
716 #define LINKTYPE_IPV4 228
717 #define LINKTYPE_IPV6 229
718
719 /*
720 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
721 * nothing), and with no FCS at the end of the frame; requested by
722 * Jon Smirl <jonsmirl@gmail.com>.
723 */
724 #define LINKTYPE_IEEE802_15_4_NOFCS 230
725
726 /*
727 * Raw D-Bus:
728 *
729 * http://www.freedesktop.org/wiki/Software/dbus
730 *
731 * messages:
732 *
733 * http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages
734 *
735 * starting with the endianness flag, followed by the message type, etc.,
736 * but without the authentication handshake before the message sequence:
737 *
738 * http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol
739 *
740 * Requested by Martin Vidner <martin@vidner.net>.
741 */
742 #define LINKTYPE_DBUS 231
743
744 /*
745 * Juniper-private data link type, as per request from
746 * Hannes Gredler <hannes@juniper.net>.
747 */
748 #define LINKTYPE_JUNIPER_VS 232
749 #define LINKTYPE_JUNIPER_SRX_E2E 233
750 #define LINKTYPE_JUNIPER_FIBRECHANNEL 234
751
752 /*
753 * DVB-CI (DVB Common Interface for communication between a PC Card
754 * module and a DVB receiver). See
755 *
756 * http://www.kaiser.cx/pcap-dvbci.html
757 *
758 * for the specification.
759 *
760 * Requested by Martin Kaiser <martin@kaiser.cx>.
761 */
762 #define LINKTYPE_DVB_CI 235
763
764 /*
765 * Variant of 3GPP TS 27.010 multiplexing protocol. Requested
766 * by Hans-Christoph Schemmel <hans-christoph.schemmel@cinterion.com>.
767 */
768 #define LINKTYPE_MUX27010 236
769
770 /*
771 * STANAG 5066 D_PDUs. Requested by M. Baris Demiray
772 * <barisdemiray@gmail.com>.
773 */
774 #define LINKTYPE_STANAG_5066_D_PDU 237
775
776 /*
777 * Juniper-private data link type, as per request from
778 * Hannes Gredler <hannes@juniper.net>.
779 */
780 #define LINKTYPE_JUNIPER_ATM_CEMIC 238
781
782 /*
783 * NetFilter LOG messages
784 * (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets)
785 *
786 * Requested by Jakub Zawadzki <darkjames-ws@darkjames.pl>
787 */
788 #define LINKTYPE_NFLOG 239
789
790 /*
791 * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
792 * for Ethernet packets with a 4-byte pseudo-header and always
793 * with the payload including the FCS, as supplied by their
794 * netANALYZER hardware and software.
795 *
796 * Requested by Holger P. Frommer <HPfrommer@hilscher.com>
797 */
798 #define LINKTYPE_NETANALYZER 240
799
800 /*
801 * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
802 * for Ethernet packets with a 4-byte pseudo-header and FCS and
803 * 1 byte of SFD, as supplied by their netANALYZER hardware and
804 * software.
805 *
806 * Requested by Holger P. Frommer <HPfrommer@hilscher.com>
807 */
808 #define LINKTYPE_NETANALYZER_TRANSPARENT 241
809
810
811 static struct linktype_map {
812 int dlt;
813 int linktype;
814 } map[] = {
815 /*
816 * These DLT_* codes have LINKTYPE_* codes with values identical
817 * to the values of the corresponding DLT_* code.
818 */
819 { DLT_NULL, LINKTYPE_NULL },
820 { DLT_EN10MB, LINKTYPE_ETHERNET },
821 { DLT_EN3MB, LINKTYPE_EXP_ETHERNET },
822 { DLT_AX25, LINKTYPE_AX25 },
823 { DLT_PRONET, LINKTYPE_PRONET },
824 { DLT_CHAOS, LINKTYPE_CHAOS },
825 { DLT_IEEE802, LINKTYPE_TOKEN_RING },
826 { DLT_ARCNET, LINKTYPE_ARCNET_BSD },
827 { DLT_SLIP, LINKTYPE_SLIP },
828 { DLT_PPP, LINKTYPE_PPP },
829 { DLT_FDDI, LINKTYPE_FDDI },
830
831 /*
832 * These DLT_* codes have different values on different
833 * platforms; we map them to LINKTYPE_* codes that
834 * have values that should never be equal to any DLT_*
835 * code.
836 */
837 #ifdef DLT_FR
838 /* BSD/OS Frame Relay */
839 { DLT_FR, LINKTYPE_FRELAY },
840 #endif
841
842 { DLT_SYMANTEC_FIREWALL, LINKTYPE_SYMANTEC_FIREWALL },
843 { DLT_ATM_RFC1483, LINKTYPE_ATM_RFC1483 },
844 { DLT_RAW, LINKTYPE_RAW },
845 { DLT_SLIP_BSDOS, LINKTYPE_SLIP_BSDOS },
846 { DLT_PPP_BSDOS, LINKTYPE_PPP_BSDOS },
847
848 /* BSD/OS Cisco HDLC */
849 { DLT_C_HDLC, LINKTYPE_C_HDLC },
850
851 /*
852 * These DLT_* codes are not on all platforms, but, so far,
853 * there don't appear to be any platforms that define
854 * other codes with those values; we map them to
855 * different LINKTYPE_* values anyway, just in case.
856 */
857
858 /* Linux ATM Classical IP */
859 { DLT_ATM_CLIP, LINKTYPE_ATM_CLIP },
860
861 /* NetBSD sync/async serial PPP (or Cisco HDLC) */
862 { DLT_PPP_SERIAL, LINKTYPE_PPP_HDLC },
863
864 /* NetBSD PPP over Ethernet */
865 { DLT_PPP_ETHER, LINKTYPE_PPP_ETHER },
866
867 /* IEEE 802.11 wireless */
868 { DLT_IEEE802_11, LINKTYPE_IEEE802_11 },
869
870 /* Frame Relay */
871 { DLT_FRELAY, LINKTYPE_FRELAY },
872
873 /* OpenBSD loopback */
874 { DLT_LOOP, LINKTYPE_LOOP },
875
876 /* OpenBSD IPSEC enc */
877 { DLT_ENC, LINKTYPE_ENC },
878
879 /* Linux cooked socket capture */
880 { DLT_LINUX_SLL, LINKTYPE_LINUX_SLL },
881
882 /* Apple LocalTalk hardware */
883 { DLT_LTALK, LINKTYPE_LTALK },
884
885 /* Acorn Econet */
886 { DLT_ECONET, LINKTYPE_ECONET },
887
888 /* OpenBSD DLT_PFLOG */
889 { DLT_PFLOG, LINKTYPE_PFLOG },
890
891 /* For Cisco-internal use */
892 { DLT_CISCO_IOS, LINKTYPE_CISCO_IOS },
893
894 /* Prism II monitor-mode header plus 802.11 header */
895 { DLT_PRISM_HEADER, LINKTYPE_PRISM_HEADER },
896
897 /* FreeBSD Aironet driver stuff */
898 { DLT_AIRONET_HEADER, LINKTYPE_AIRONET_HEADER },
899
900 /* Siemens HiPath HDLC */
901 { DLT_HHDLC, LINKTYPE_HHDLC },
902
903 /* RFC 2625 IP-over-Fibre Channel */
904 { DLT_IP_OVER_FC, LINKTYPE_IP_OVER_FC },
905
906 /* Solaris+SunATM */
907 { DLT_SUNATM, LINKTYPE_SUNATM },
908
909 /* RapidIO */
910 { DLT_RIO, LINKTYPE_RIO },
911
912 /* PCI Express */
913 { DLT_PCI_EXP, LINKTYPE_PCI_EXP },
914
915 /* Xilinx Aurora link layer */
916 { DLT_AURORA, LINKTYPE_AURORA },
917
918 /* 802.11 plus BSD radio header */
919 { DLT_IEEE802_11_RADIO, LINKTYPE_IEEE802_11_RADIO },
920
921 /* Tazmen Sniffer Protocol */
922 { DLT_TZSP, LINKTYPE_TZSP },
923
924 /* Arcnet with Linux-style link-layer headers */
925 { DLT_ARCNET_LINUX, LINKTYPE_ARCNET_LINUX },
926
927 /* Juniper-internal chassis encapsulation */
928 { DLT_JUNIPER_MLPPP, LINKTYPE_JUNIPER_MLPPP },
929 { DLT_JUNIPER_MLFR, LINKTYPE_JUNIPER_MLFR },
930 { DLT_JUNIPER_ES, LINKTYPE_JUNIPER_ES },
931 { DLT_JUNIPER_GGSN, LINKTYPE_JUNIPER_GGSN },
932 { DLT_JUNIPER_MFR, LINKTYPE_JUNIPER_MFR },
933 { DLT_JUNIPER_ATM2, LINKTYPE_JUNIPER_ATM2 },
934 { DLT_JUNIPER_SERVICES, LINKTYPE_JUNIPER_SERVICES },
935 { DLT_JUNIPER_ATM1, LINKTYPE_JUNIPER_ATM1 },
936
937 /* Apple IP-over-IEEE 1394 cooked header */
938 { DLT_APPLE_IP_OVER_IEEE1394, LINKTYPE_APPLE_IP_OVER_IEEE1394 },
939
940 /* SS7 */
941 { DLT_MTP2_WITH_PHDR, LINKTYPE_MTP2_WITH_PHDR },
942 { DLT_MTP2, LINKTYPE_MTP2 },
943 { DLT_MTP3, LINKTYPE_MTP3 },
944 { DLT_SCCP, LINKTYPE_SCCP },
945
946 /* DOCSIS MAC frames */
947 { DLT_DOCSIS, LINKTYPE_DOCSIS },
948
949 /* IrDA IrLAP packets + Linux-cooked header */
950 { DLT_LINUX_IRDA, LINKTYPE_LINUX_IRDA },
951
952 /* IBM SP and Next Federation switches */
953 { DLT_IBM_SP, LINKTYPE_IBM_SP },
954 { DLT_IBM_SN, LINKTYPE_IBM_SN },
955
956 /* 802.11 plus AVS radio header */
957 { DLT_IEEE802_11_RADIO_AVS, LINKTYPE_IEEE802_11_RADIO_AVS },
958
959 /*
960 * Any platform that defines additional DLT_* codes should:
961 *
962 * request a LINKTYPE_* code and value from tcpdump.org,
963 * as per the above;
964 *
965 * add, in their version of libpcap, an entry to map
966 * those DLT_* codes to the corresponding LINKTYPE_*
967 * code;
968 *
969 * redefine, in their "net/bpf.h", any DLT_* values
970 * that collide with the values used by their additional
971 * DLT_* codes, to remove those collisions (but without
972 * making them collide with any of the LINKTYPE_*
973 * values equal to 50 or above; they should also avoid
974 * defining DLT_* values that collide with those
975 * LINKTYPE_* values, either).
976 */
977
978 /* Juniper-internal chassis encapsulation */
979 { DLT_JUNIPER_MONITOR, LINKTYPE_JUNIPER_MONITOR },
980
981 /* BACnet MS/TP */
982 { DLT_BACNET_MS_TP, LINKTYPE_BACNET_MS_TP },
983
984 /* PPP for pppd, with direction flag in the PPP header */
985 { DLT_PPP_PPPD, LINKTYPE_PPP_PPPD},
986
987 /* Juniper-internal chassis encapsulation */
988 { DLT_JUNIPER_PPPOE, LINKTYPE_JUNIPER_PPPOE },
989 { DLT_JUNIPER_PPPOE_ATM,LINKTYPE_JUNIPER_PPPOE_ATM },
990
991 /* GPRS LLC */
992 { DLT_GPRS_LLC, LINKTYPE_GPRS_LLC },
993
994 /* Transparent Generic Framing Procedure (ITU-T G.7041/Y.1303) */
995 { DLT_GPF_T, LINKTYPE_GPF_T },
996
997 /* Framed Generic Framing Procedure (ITU-T G.7041/Y.1303) */
998 { DLT_GPF_F, LINKTYPE_GPF_F },
999
1000 { DLT_GCOM_T1E1, LINKTYPE_GCOM_T1E1 },
1001 { DLT_GCOM_SERIAL, LINKTYPE_GCOM_SERIAL },
1002
1003 /* Juniper-internal chassis encapsulation */
1004 { DLT_JUNIPER_PIC_PEER, LINKTYPE_JUNIPER_PIC_PEER },
1005
1006 /* Endace types */
1007 { DLT_ERF_ETH, LINKTYPE_ERF_ETH },
1008 { DLT_ERF_POS, LINKTYPE_ERF_POS },
1009
1010 /* viSDN LAPD */
1011 { DLT_LINUX_LAPD, LINKTYPE_LINUX_LAPD },
1012
1013 /* Juniper meta-information before Ether, PPP, Frame Relay, C-HDLC Frames */
1014 { DLT_JUNIPER_ETHER, LINKTYPE_JUNIPER_ETHER },
1015 { DLT_JUNIPER_PPP, LINKTYPE_JUNIPER_PPP },
1016 { DLT_JUNIPER_FRELAY, LINKTYPE_JUNIPER_FRELAY },
1017 { DLT_JUNIPER_CHDLC, LINKTYPE_JUNIPER_CHDLC },
1018
1019 /* Multi Link Frame Relay (FRF.16) */
1020 { DLT_MFR, LINKTYPE_MFR },
1021
1022 /* Juniper Voice PIC */
1023 { DLT_JUNIPER_VP, LINKTYPE_JUNIPER_VP },
1024
1025 /* Controller Area Network (CAN) v2.0B */
1026 { DLT_A429, LINKTYPE_A429 },
1027
1028 /* Arinc 653 Interpartition Communication messages */
1029 { DLT_A653_ICM, LINKTYPE_A653_ICM },
1030
1031 /* USB */
1032 { DLT_USB, LINKTYPE_USB },
1033
1034 /* Bluetooth HCI UART transport layer */
1035 { DLT_BLUETOOTH_HCI_H4, LINKTYPE_BLUETOOTH_HCI_H4 },
1036
1037 /* IEEE 802.16 MAC Common Part Sublayer */
1038 { DLT_IEEE802_16_MAC_CPS, LINKTYPE_IEEE802_16_MAC_CPS },
1039
1040 /* USB with Linux header */
1041 { DLT_USB_LINUX, LINKTYPE_USB_LINUX },
1042
1043 /* Controller Area Network (CAN) v2.0B */
1044 { DLT_CAN20B, LINKTYPE_CAN20B },
1045
1046 /* IEEE 802.15.4 with address fields padded */
1047 { DLT_IEEE802_15_4_LINUX, LINKTYPE_IEEE802_15_4_LINUX },
1048
1049 /* Per Packet Information encapsulated packets */
1050 { DLT_PPI, LINKTYPE_PPI },
1051
1052 /* IEEE 802.16 MAC Common Part Sublayer plus radiotap header */
1053 { DLT_IEEE802_16_MAC_CPS_RADIO, LINKTYPE_IEEE802_16_MAC_CPS_RADIO },
1054
1055 /* Juniper Voice ISM */
1056 { DLT_JUNIPER_ISM, LINKTYPE_JUNIPER_ISM },
1057
1058 /* IEEE 802.15.4 exactly as it appears in the spec, with FCS */
1059 { DLT_IEEE802_15_4, LINKTYPE_IEEE802_15_4 },
1060
1061 /* Various link-layer types for SITA */
1062 { DLT_SITA, LINKTYPE_SITA },
1063
1064 /* Various link-layer types for Endace */
1065 { DLT_ERF, LINKTYPE_ERF },
1066
1067 /* Special header for u10 Networks boards */
1068 { DLT_RAIF1, LINKTYPE_RAIF1 },
1069
1070 /* IPMB */
1071 { DLT_IPMB, LINKTYPE_IPMB },
1072
1073 /* Juniper Secure Tunnel */
1074 { DLT_JUNIPER_ST, LINKTYPE_JUNIPER_ST },
1075
1076 /* Bluetooth HCI UART transport layer, with pseudo-header */
1077 { DLT_BLUETOOTH_HCI_H4_WITH_PHDR, LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR },
1078
1079 /* AX.25 with KISS header */
1080 { DLT_AX25_KISS, LINKTYPE_AX25_KISS },
1081
1082 /* Raw LAPD, with no pseudo-header */
1083 { DLT_LAPD, LINKTYPE_LAPD },
1084
1085 /* PPP with one-byte pseudo-header giving direction */
1086 { DLT_PPP_WITH_DIR, LINKTYPE_PPP_WITH_DIR },
1087
1088 /* Cisco HDLC with one-byte pseudo-header giving direction */
1089 { DLT_C_HDLC_WITH_DIR, LINKTYPE_C_HDLC_WITH_DIR },
1090
1091 /* Frame Relay with one-byte pseudo-header giving direction */
1092 { DLT_FRELAY_WITH_DIR, LINKTYPE_FRELAY_WITH_DIR },
1093
1094 /* LAPB with one-byte pseudo-header giving direction */
1095 { DLT_LAPB_WITH_DIR, LINKTYPE_LAPB_WITH_DIR },
1096
1097 /* IPMB with Linux pseudo-header */
1098 { DLT_IPMB_LINUX, LINKTYPE_IPMB_LINUX },
1099
1100 /* FlexRay */
1101 { DLT_FLEXRAY, LINKTYPE_FLEXRAY },
1102
1103 /* MOST */
1104 { DLT_MOST, LINKTYPE_MOST },
1105
1106 /* LIN */
1107 { DLT_LIN, LINKTYPE_LIN },
1108
1109 /* X2E-private serial line capture */
1110 { DLT_X2E_SERIAL, LINKTYPE_X2E_SERIAL },
1111
1112 /* X2E-private for Xoraya data logger family */
1113 { DLT_X2E_XORAYA, LINKTYPE_X2E_XORAYA },
1114
1115 /* IEEE 802.15.4 with PHY data for non-ASK PHYs */
1116 { DLT_IEEE802_15_4_NONASK_PHY, LINKTYPE_IEEE802_15_4_NONASK_PHY },
1117
1118 /* Input device events from Linux /dev/input/eventN devices */
1119 { DLT_LINUX_EVDEV, LINKTYPE_LINUX_EVDEV },
1120
1121 /* GSM types */
1122 { DLT_GSMTAP_UM, LINKTYPE_GSMTAP_UM },
1123 { DLT_GSMTAP_ABIS, LINKTYPE_GSMTAP_ABIS },
1124
1125 /* MPLS, with an MPLS label as the link-layer header */
1126 { DLT_MPLS, LINKTYPE_MPLS },
1127
1128 /* USB with padded Linux header */
1129 { DLT_USB_LINUX_MMAPPED, LINKTYPE_USB_LINUX_MMAPPED },
1130
1131 /* DECT packets with a pseudo-header */
1132 { DLT_DECT, LINKTYPE_DECT },
1133
1134 /* AOS Space Data Link Protocol */
1135 { DLT_AOS, LINKTYPE_AOS },
1136
1137 /* Wireless HART */
1138 { DLT_WIHART, LINKTYPE_WIHART },
1139
1140 /* Fibre Channel FC-2 frames without SOF or EOF */
1141 { DLT_FC_2, LINKTYPE_FC_2 },
1142
1143 /* Fibre Channel FC-2 frames with SOF and EOF */
1144 { DLT_FC_2_WITH_FRAME_DELIMS, LINKTYPE_FC_2_WITH_FRAME_DELIMS },
1145
1146 /* Solaris IPNET */
1147 { DLT_IPNET, LINKTYPE_IPNET },
1148
1149 /* CAN frames with SocketCAN headers */
1150 { DLT_CAN_SOCKETCAN, LINKTYPE_CAN_SOCKETCAN },
1151
1152 /* Raw IPv4/IPv6 */
1153 { DLT_IPV4, LINKTYPE_IPV4 },
1154 { DLT_IPV6, LINKTYPE_IPV6 },
1155
1156 /* IEEE 802.15.4 exactly as it appears in the spec, without FCS */
1157 { DLT_IEEE802_15_4_NOFCS, LINKTYPE_IEEE802_15_4_NOFCS },
1158
1159 /* D-Bus messages */
1160 { DLT_DBUS, LINKTYPE_DBUS },
1161
1162 /* Juniper Virtual Server */
1163 { DLT_JUNIPER_VS, LINKTYPE_JUNIPER_VS },
1164
1165 /* Juniper SRX E2E debugging */
1166 { DLT_JUNIPER_SRX_E2E, LINKTYPE_JUNIPER_SRX_E2E },
1167
1168 /* Juniper Fibrechannel */
1169 { DLT_JUNIPER_FIBRECHANNEL, LINKTYPE_JUNIPER_FIBRECHANNEL },
1170
1171 /* DVB-CI */
1172 { DLT_DVB_CI, LINKTYPE_DVB_CI },
1173
1174 /* Variant of 3GPP TS 27.010 */
1175 { DLT_MUX27010, LINKTYPE_MUX27010 },
1176
1177 /* STANAG 5066 D_PDUs */
1178 { DLT_STANAG_5066_D_PDU, LINKTYPE_STANAG_5066_D_PDU },
1179
1180 /* Juniper ATM CE MIC */
1181 { DLT_JUNIPER_ATM_CEMIC, LINKTYPE_JUNIPER_ATM_CEMIC },
1182
1183 /* Linux NetFilter LOG messages */
1184 { DLT_NFLOG, LINKTYPE_NFLOG },
1185
1186 /* Ethernet with Hilscher netANALYZER pseudo-header */
1187 { DLT_NETANALYZER, LINKTYPE_NETANALYZER },
1188
1189 /* Ethernet with Hilscher netANALYZER pseudo-header and with preamble/SFD */
1190 { DLT_NETANALYZER_TRANSPARENT, LINKTYPE_NETANALYZER_TRANSPARENT },
1191
1192 { -1, -1 }
1193 };
1194
1195 int
1196 dlt_to_linktype(int dlt)
1197 {
1198 int i;
1199
1200 for (i = 0; map[i].dlt != -1; i++) {
1201 if (map[i].dlt == dlt)
1202 return (map[i].linktype);
1203 }
1204
1205 /*
1206 * If we don't have a mapping for this DLT_ code, return an
1207 * error; that means that the table above needs to have an
1208 * entry added.
1209 */
1210 return (-1);
1211 }
1212
1213 int
1214 linktype_to_dlt(int linktype)
1215 {
1216 int i;
1217
1218 for (i = 0; map[i].linktype != -1; i++) {
1219 if (map[i].linktype == linktype)
1220 return (map[i].dlt);
1221 }
1222
1223 /*
1224 * If we don't have an entry for this link type, return
1225 * the link type value; it may be a DLT_ value from an
1226 * older version of libpcap.
1227 */
1228 return linktype;
1229 }
1230
1231 /*
1232 * The DLT_USB_LINUX and DLT_USB_LINUX_MMAPPED headers are in host
1233 * byte order when capturing (it's supplied directly from a
1234 * memory-mapped buffer shared by the kernel).
1235 *
1236 * When reading a DLT_USB_LINUX or DLT_USB_LINUX_MMAPPED capture file,
1237 * we need to convert it from the capturing host's byte order to
1238 * the reading host's byte order.
1239 */
1240 void
1241 swap_linux_usb_header(const struct pcap_pkthdr *hdr, u_char *buf,
1242 int header_len_64_bytes)
1243 {
1244 pcap_usb_header_mmapped *uhdr = (pcap_usb_header_mmapped *)buf;
1245 bpf_u_int32 offset = 0;
1246 usb_isodesc *pisodesc;
1247 int32_t numdesc, i;
1248
1249 /*
1250 * "offset" is the offset *past* the field we're swapping;
1251 * we skip the field *before* checking to make sure
1252 * the captured data length includes the entire field.
1253 */
1254
1255 /*
1256 * The URB id is a totally opaque value; do we really need to
1257 * convert it to the reading host's byte order???
1258 */
1259 offset += 8; /* skip past id */
1260 if (hdr->caplen < offset)
1261 return;
1262 uhdr->id = SWAPLL(uhdr->id);
1263
1264 offset += 4; /* skip past various 1-byte fields */
1265
1266 offset += 2; /* skip past bus_id */
1267 if (hdr->caplen < offset)
1268 return;
1269 uhdr->bus_id = SWAPSHORT(uhdr->bus_id);
1270
1271 offset += 2; /* skip past various 1-byte fields */
1272
1273 offset += 8; /* skip past ts_sec */
1274 if (hdr->caplen < offset)
1275 return;
1276 uhdr->ts_sec = SWAPLL(uhdr->ts_sec);
1277
1278 offset += 4; /* skip past ts_usec */
1279 if (hdr->caplen < offset)
1280 return;
1281 uhdr->ts_usec = SWAPLONG(uhdr->ts_usec);
1282
1283 offset += 4; /* skip past status */
1284 if (hdr->caplen < offset)
1285 return;
1286 uhdr->status = SWAPLONG(uhdr->status);
1287
1288 offset += 4; /* skip past urb_len */
1289 if (hdr->caplen < offset)
1290 return;
1291 uhdr->urb_len = SWAPLONG(uhdr->urb_len);
1292
1293 offset += 4; /* skip past data_len */
1294 if (hdr->caplen < offset)
1295 return;
1296 uhdr->data_len = SWAPLONG(uhdr->data_len);
1297
1298 if (uhdr->transfer_type == URB_ISOCHRONOUS) {
1299 offset += 4; /* skip past s.iso.error_count */
1300 if (hdr->caplen < offset)
1301 return;
1302 uhdr->s.iso.error_count = SWAPLONG(uhdr->s.iso.error_count);
1303
1304 offset += 4; /* skip past s.iso.numdesc */
1305 if (hdr->caplen < offset)
1306 return;
1307 uhdr->s.iso.numdesc = SWAPLONG(uhdr->s.iso.numdesc);
1308 } else
1309 offset += 8; /* skip USB setup header */
1310
1311 if (header_len_64_bytes) {
1312 /*
1313 * This is either the "version 1" header, with
1314 * 16 bytes of additional fields at the end, or
1315 * a "version 0" header from a memory-mapped
1316 * capture, with 16 bytes of zeroed-out padding
1317 * at the end. Byte swap them as if this were
1318 * a "version 1" header.
1319 */
1320 offset += 4; /* skip past interval */
1321 if (hdr->caplen < offset)
1322 return;
1323 uhdr->interval = SWAPLONG(uhdr->interval);
1324
1325 offset += 4; /* skip past start_frame */
1326 if (hdr->caplen < offset)
1327 return;
1328 uhdr->start_frame = SWAPLONG(uhdr->start_frame);
1329
1330 offset += 4; /* skip past xfer_flags */
1331 if (hdr->caplen < offset)
1332 return;
1333 uhdr->xfer_flags = SWAPLONG(uhdr->xfer_flags);
1334
1335 offset += 4; /* skip past ndesc */
1336 if (hdr->caplen < offset)
1337 return;
1338 uhdr->ndesc = SWAPLONG(uhdr->ndesc);
1339 }
1340
1341 if (uhdr->transfer_type == URB_ISOCHRONOUS) {
1342 /* swap the values in struct linux_usb_isodesc */
1343 pisodesc = (usb_isodesc *)(void *)(buf+offset);
1344 numdesc = uhdr->s.iso.numdesc;
1345 for (i = 0; i < numdesc; i++) {
1346 offset += 4; /* skip past status */
1347 if (hdr->caplen < offset)
1348 return;
1349 pisodesc->status = SWAPLONG(pisodesc->status);
1350
1351 offset += 4; /* skip past offset */
1352 if (hdr->caplen < offset)
1353 return;
1354 pisodesc->offset = SWAPLONG(pisodesc->offset);
1355
1356 offset += 4; /* skip past len */
1357 if (hdr->caplen < offset)
1358 return;
1359 pisodesc->len = SWAPLONG(pisodesc->len);
1360
1361 offset += 4; /* skip past padding */
1362
1363 pisodesc++;
1364 }
1365 }
1366 }
[mirror] the LIBpcap interface to various kernel packet capture mechanism