1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
--- ttt-1.8/net_read.c 2003-10-16 13:55:18.000000000 +0200
+++ ttt-1.8/net_read.c.new 2004-02-09 19:40:31.000000000 +0100
@@ -172,6 +172,10 @@
static void pflog_if_read(u_char *user, const struct pcap_pkthdr *h,
const u_char *p);
#endif
+#ifdef DLT_LINUX_SLL /* linux specific */
+static void linux_sll_if_read(u_char *user, const struct pcap_pkthdr *h,
+ const u_char *p);
+#endif
static int ether_encap_read(u_short ethtype, const u_char *p,
int length, int caplen);
static int llc_read(const u_char *p, const int length, const int caplen);
@@ -664,6 +668,55 @@
}
#endif
+#ifdef DLT_LINUX_SLL
+
+#define SLL_HEADER_SIZE 16
+#define SLL_ADDRLEN 8 /* length of address field */
+
+struct sll_header {
+ u_int16_t sll_pkttype; /* packet type */
+ u_int16_t sll_hatype; /* link-layer address type */
+ u_int16_t sll_halen; /* link-layer address length */
+ u_int8_t sll_addr[SLL_ADDRLEN]; /* link-layer address */
+ u_int16_t sll_protocol; /* protocol */
+};
+
+#define LINUX_SLL_P_802_2 0x0004
+
+static void
+linux_sll_if_read(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
+{
+ int caplen = h->caplen;
+ int length = h->len;
+ struct sll_header *hdr = (struct sll_header *)p;
+ int protocol;
+
+ packet_length = length; /* save data link level packet length */
+ if (caplen < SLL_HEADER_SIZE) {
+ return;
+ }
+
+ p += SLL_HEADER_SIZE;
+ length -= SLL_HEADER_SIZE;
+ caplen -= SLL_HEADER_SIZE;
+
+ protocol = ntohs(hdr->sll_protocol);
+
+ if (protocol <= 1536) {
+
+ switch (protocol) {
+
+ case LINUX_SLL_P_802_2:
+ llc_read(p, length, caplen);
+ break;
+
+ }
+ } else
+ ether_encap_read(protocol, p, length, caplen);
+}
+
+#endif
+
#ifdef PFLOG_HDRLEN
static void
@@ -1094,6 +1147,9 @@
#ifdef PFLOG_HDRLEN
{ pflog_if_read, DLT_PFLOG },
#endif
+#ifdef DLT_LINUX_SLL
+ { linux_sll_if_read, DLT_LINUX_SLL },
+#endif
{ NULL, 0 },
};
|
GitWeb