path: root/pcap.h
diff options
authorguy <guy>2000-09-17 04:04:36 +0000
committerguy <guy>2000-09-17 04:04:36 +0000
commit781fae35715227add96c7acbfdfc04711c285bde (patch)
tree344180bec293a8ab98235f738f9e859e4e65e37a /pcap.h
parent74ab49bec1f5d0ba7e41b395b1ddb6df8f2e2298 (diff)
Introduce a set of PCAP_ENCAP_ codes to specify packet encapsulations.
For those PCAP_ENCAP_ codes corresponding to DLT_ codes that are (believed to be) the same in all BSDs, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that were added in libpcap 0.5 as "non-kernel" DLT_ codes, or had their values changed in libpcap 0.5 in order to cope with the fact that those DLT_ codes have different values in different systems, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. We add some additional PCAP_ENCAP_ codes to handle IEEE 802.11 (which currently has its link-layer information turned into an Ethernet header by at least some of the BSDs, but John Hawkinson at MIT wants to add a DLT_ value for 802.11 and pass up the full link-layer header) and the Classical IP encapsulation for ATM on Linux (which isn't always the same as DLT_ATM_RFC1483, from what I can tell, alas). "pcap-bpf.c" maps DLT_ codes to PCAP_ENCAP_ codes, so as not to supply to libpcap's callers any DLT_ codes other than the ones that have the same values on all platforms; it supplies PCAP_ENCAP_ codes for all others. In libpcap's "bpf/net/bpf.h", we define the DLT_ values that aren't the same on all platforms with the new values starting at 100 (to keep them out of the way of the values various BSDs might assign to them), as we did in 0.5, but do so only if they're not already defined; platforms with <net/bpf.h> headers that come with the kernel (e.g., the BSDs) should define them with the values that they have always had on that platform, *not* with the values we used in 0.5. (Code using this version of libpcap should check for the new PCAP_ENCAP_ codes; those are given the values that the corresponding DLT_ values had in 0.5, so code that checks for them will handle 0.5 libpcap files correctly even if the platform defines DLT_RAW, say, as something other than 101. If that code also checks for DLT_RAW - which means it can't just use a switch statement, as DLT_RAW might be defined as 101 if the platform doesn't itself define DLT_RAW with some other value - then it will also handle old DLT_RAW captures, as long as they were made on the same platform or on another platform that used the same value for DLT_RAW. It can't handle captures from a platform that uses that value for another DLT_ code, but that's always been the case, and isn't easily fixable.) The intent here is to decouple the values that are returned by "pcap_datalink()" and put into the header of tcpdump/libpcap save files from the DLT_ values returned by BIOCGDLT in BSD kernels, allowing the BSDs to assign values to DLT_ codes, in their kernels, as they choose, without creating more incompatibilities between tcpdump/libpcap save files from different platforms.
Diffstat (limited to 'pcap.h')
1 files changed, 78 insertions, 2 deletions
diff --git a/pcap.h b/pcap.h
index 4bf8596..cf6fcdc 100644
--- a/pcap.h
+++ b/pcap.h
@@ -30,7 +30,7 @@
- * @(#) $Header: /tcpdump/master/libpcap/pcap.h,v 1.25 2000-09-14 09:49:29 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/libpcap/pcap.h,v 1.26 2000-09-17 04:04:39 guy Exp $ (LBL)
#ifndef lib_pcap_h
@@ -98,10 +98,86 @@ struct pcap_file_header {
bpf_int32 thiszone; /* gmt to local correction */
bpf_u_int32 sigfigs; /* accuracy of timestamps */
bpf_u_int32 snaplen; /* max length saved portion of each pkt */
- bpf_u_int32 linktype; /* data link type (DLT_*) */
+ bpf_u_int32 linktype; /* data link type (PCAP_ENCAP_*) */
+ * Values for "linktype" in the file header.
+ *
+ * In the past, these have been DLT_ codes defined by <net/bpf.h>.
+ * Those codes were used in two places:
+ *
+ * inside BSD kernels, as the value returned by the BIOCGDLT ioctl
+ * for "/dev/bpfN" devices;
+ *
+ * inside libpcap capture file headers.
+ *
+ * Unfortunately, the various flavors of BSD have not always used the same
+ * numerical values for the same data types, and various patches to
+ * libpcap for non-BSD OSes have added their own DLT_ codes for link
+ * layer encapsulation types seen on those OSes, and those codes have had,
+ * in some cases, values that were also used, on other platforms, for other
+ * link layer encapsulation types.
+ *
+ * This means that capture files of a type whose numerical DLT_ code
+ * means different things on different BSDs, or with different versions
+ * of libpcap, can't always be read on systems other than those like
+ * the one running on the machine on which the capture was made.
+ *
+ * We therefore now, in an attempt to decouple the values supplied by
+ * BIOCGDLT from the values used in the libpcap file header, define
+ * a set of PCAP_ENCAP_* codes to be used in the header; "pcap_open_live()"
+ * in the various "pcap-bpf.c" files should set the "linktype" field of
+ * the "pcap_t" it returns to a PCAP_ENCAP_* code, not to a DLT_* code.
+ *
+ * For those DLT_* codes that have, as far as we know, the same values on
+ * all platforms (DLT_NULL through DLT_FDDI), we define PCAP_ENCAP_xxx as
+ * DLT_xxx; this means that captures of those types will continue to use
+ * the same "linktype" value, and thus will continue to be readable by
+ * older versions of libpcap.
+ *
+ * The other PCAP_ENCAP_* codes are given values starting at 100, in the
+ * hopes that no DLT_* code will be given one of those values.
+ *
+ * In order to ensure that a given PCAP_ENCAP_* code's value will refer to
+ * the same encapsulation type on all platforms, you should not allocate
+ * a new PCAP_ENCAP_* value without consulting "tcpdump-workers@tcpdump.org".
+ * The tcpdump developers will allocate a value for you, and will not
+ * subsequently allocate it to anybody else; that value will be added to
+ * the "pcap.h" in the tcpdump.org CVS repository, so that a future
+ * libpcap release will include it.
+ *
+ * You should, if possible, also contribute patches to libpcap and tcpdump
+ * to handle the new encapsulation type, so that they can also be checked
+ * into the tcpdump.org CVS repository and so that they will appear in
+ * future libpcap and tcpdump releases.
+ *
+ * PCAP_ENCAP_* codes should not be used inside kernels; DLT_* codes
+ * should be used inside kernels that support BSD's BPF mechanism (other
+ * kernels may use other codes, e.g. ARPHRD_* codes in Linux kernels
+ * and DL_* codes in kernels using DLPI).
+ */
+#define PCAP_ENCAP_ETHERNET DLT_EN10MB /* also for 100Mb and up */
+#define PCAP_ENCAP_EXP_ETHERNET DLT_EN3MB /* 3Mb experimental Ethernet */
+#define PCAP_ENCAP_AX25 DLT_AX25
+#define PCAP_ENCAP_TOKEN_RING DLT_IEEE802 /* DLT_IEEE802 is used for Token Ring */
+#define PCAP_ENCAP_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */
+#define PCAP_ENCAP_RAW 101 /* raw IP */
+#define PCAP_ENCAP_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */
+#define PCAP_ENCAP_PPP_BSDOS 103 /* BSD/OS PPP BPF header */
+#define PCAP_ENCAP_C_HDLC 104 /* Cisco HDLC */
+#define PCAP_ENCAP_IEEE802_11 105 /* IEEE 802.11 (wireless) */
+#define PCAP_ENCAP_ATM_CLIP 106 /* Linux Classical IP over ATM */
* Each packet in the dump file is prepended with this generic header.
* This gets around the problem of different headers for different
* packet interfaces.