Fix printing of Linux cooked captures with monitor-mode packets.

Apparently, if you have an interface in monitor mode, capturing on the
"any" device can get packets that have a SLL hatype of 803, which is the
ARPHRD_ value for radiotap, and with the payload containing a radiotap
header, followed by an 802.11 header, followed by the 802.11 payload.
Handle that.

(backported from commit 83e419c6289a395a0443f2dac24bb004e839f202)

diff --git a/netdissect.h b/netdissect.h
index 089b04061ea2d26191c3956853e3b09b53b89b8b..b2d4ecf962ebaf48072e648d90f85e3f013609c3 100644 (file)
--- a/netdissect.h
+++ b/netdissect.h
@@ -514,6 +514,7 @@ extern void hsrp_print(netdissect_options *, const u_char *, u_int);
 extern void http_print(netdissect_options *, const u_char *, u_int);
 extern void icmp6_print(netdissect_options *, const u_char *, u_int, const u_char *, int);
 extern void icmp_print(netdissect_options *, const u_char *, u_int, const u_char *, int);
+extern u_int ieee802_11_radio_print(netdissect_options *, const u_char *, u_int, u_int);
 extern void igmp_print(netdissect_options *, const u_char *, u_int);
 extern void igrp_print(netdissect_options *, const u_char *, u_int);
 extern void ip6_print(netdissect_options *, const u_char *, u_int);

diff --git a/print-802_11.c b/print-802_11.c
index 22337a40d8eeac9e5fff38b7264ea79bdff93f50..7c65941ae02992ba229322588076d03d516e2533 100644 (file)
--- a/print-802_11.c
+++ b/print-802_11.c
@@ -3071,7 +3071,7 @@ print_in_radiotap_namespace(netdissect_options *ndo,
        return 0;
 }
 
-static u_int
+u_int
 ieee802_11_radio_print(netdissect_options *ndo,
                        const u_char *p, u_int length, u_int caplen)
 {

diff --git a/print-sll.c b/print-sll.c
index 6148569ec160802ca48001223953ff1a16716b1e..9bc5d2015ec28f8396fbe511cf6b2b46a07ba015 100644 (file)
--- a/print-sll.c
+++ b/print-sll.c
@@ -198,6 +198,7 @@ sll_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char
        u_int caplen = h->caplen;
        u_int length = h->len;
        register const struct sll_header *sllp;
+       u_short hatype;
        u_short ether_type;
        int llc_hdrlen;
        u_int hdrlen;
@@ -225,6 +226,16 @@ sll_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char
        p += SLL_HDR_LEN;
        hdrlen = SLL_HDR_LEN;
 
+       hatype = EXTRACT_16BITS(&sllp->sll_hatype);
+       switch (hatype) {
+
+       case 803:
+               /*
+                * This is an packet with a radiotap header;
+                * just dissect the payload as such.
+                */
+               return (SLL_HDR_LEN + ieee802_11_radio_print(ndo, p, length, caplen));
+       }
        ether_type = EXTRACT_16BITS(&sllp->sll_protocol);
 
 recurse: