aboutsummaryrefslogtreecommitdiffstats
path: root/pcap-snoop.c
diff options
context:
space:
mode:
authorguy <guy>2003-12-18 23:32:31 +0000
committerguy <guy>2003-12-18 23:32:31 +0000
commit619a9fe31b91dc70a28efe6a38e63d630e7397df (patch)
tree34fdb5bb37e016a8a7066ca9a3aceef7259d919b /pcap-snoop.c
parent22a42b8996ccdd27920f2e4d7eb76b54564a2b33 (diff)
For devices that we have some reason to believe are real live Ethernet
devices, offer DLT_DOCSIS as one of the choices of link-layer type, and support setting that type as meaning just "set libpcap's notion of the link-layer type to DLT_DOCSIS" without telling the driver to use DLT_DOCSIS.
Diffstat (limited to 'pcap-snoop.c')
-rw-r--r--pcap-snoop.c36
1 files changed, 35 insertions, 1 deletions
diff --git a/pcap-snoop.c b/pcap-snoop.c
index d216ba9..7ea8394 100644
--- a/pcap-snoop.c
+++ b/pcap-snoop.c
@@ -20,7 +20,7 @@
*/
#ifndef lint
static const char rcsid[] _U_ =
- "@(#) $Header: /tcpdump/master/libpcap/pcap-snoop.c,v 1.49 2003-11-21 10:19:35 guy Exp $ (LBL)";
+ "@(#) $Header: /tcpdump/master/libpcap/pcap-snoop.c,v 1.50 2003-12-18 23:32:33 guy Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
@@ -237,6 +237,35 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
p->linktype = DLT_EN10MB;
p->offset = RAW_HDRPAD(sizeof(struct ether_header));
ll_hdrlen = sizeof(struct ether_header);
+ /*
+ * This is (presumably) a real Ethernet capture; give it a
+ * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
+ * that an application can let you choose it, in case you're
+ * capturing DOCSIS traffic that a Cisco Cable Modem
+ * Termination System is putting out onto an Ethernet (it
+ * doesn't put an Ethernet header onto the wire, it puts raw
+ * DOCSIS frames out on the wire inside the low-level
+ * Ethernet framing).
+ *
+ * XXX - are there any sorts of "fake Ethernet" that have
+ * Ethernet link-layer headers but that *shouldn't offer
+ * DLT_DOCSIS as a Cisco CMTS won't put traffic onto it
+ * or get traffic bridged onto it? "el" is for ATM LANE
+ * Ethernet devices, so that might be the case for them;
+ * the same applies for "qaa" classical IP devices. If
+ * "fa" devices are for FORE SPANS, that'd apply to them
+ * as well; what are "cip" devices - some other ATM
+ * Classical IP devices?
+ */
+ handle->dlt_list = (u_int *) malloc(sizeof(u_int) * 2);
+ /*
+ * If that fails, just leave the list empty.
+ */
+ if (handle->dlt_list != NULL) {
+ handle->dlt_list[0] = DLT_EN10MB;
+ handle->dlt_list[1] = DLT_DOCSIS;
+ handle->dlt_count = 2;
+ }
} else if (strncmp("ipg", device, 3) == 0 ||
strncmp("rns", device, 3) == 0 || /* O2/200/2000 FDDI */
strncmp("xpi", device, 3) == 0) {
@@ -339,6 +368,11 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
return (p);
bad:
(void)close(fd);
+ /*
+ * Get rid of any link-layer type list we allocated.
+ */
+ if (p->dlt_list != NULL)
+ free(p->dlt_list);
free(p);
return (NULL);
}