1 | #include <machine/rtems-bsd-user-space.h> |
---|
2 | |
---|
3 | /* |
---|
4 | * Copyright (c) 1993, 1994, 1995, 1996, 1997 |
---|
5 | * The Regents of the University of California. All rights reserved. |
---|
6 | * |
---|
7 | * Redistribution and use in source and binary forms, with or without |
---|
8 | * modification, are permitted provided that: (1) source code distributions |
---|
9 | * retain the above copyright notice and this paragraph in its entirety, (2) |
---|
10 | * distributions including binary code include the above copyright notice and |
---|
11 | * this paragraph in its entirety in the documentation or other materials |
---|
12 | * provided with the distribution, and (3) all advertising materials mentioning |
---|
13 | * features or use of this software display the following acknowledgement: |
---|
14 | * ``This product includes software developed by the University of California, |
---|
15 | * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of |
---|
16 | * the University nor the names of its contributors may be used to endorse |
---|
17 | * or promote products derived from this software without specific prior |
---|
18 | * written permission. |
---|
19 | * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED |
---|
20 | * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF |
---|
21 | * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. |
---|
22 | * |
---|
23 | * pcap-common.c - common code for pcap and pcap-ng files |
---|
24 | */ |
---|
25 | |
---|
26 | #ifdef HAVE_CONFIG_H |
---|
27 | #include "config.h" |
---|
28 | #endif |
---|
29 | |
---|
30 | #ifdef WIN32 |
---|
31 | #include <pcap-stdinc.h> |
---|
32 | #else /* WIN32 */ |
---|
33 | #if HAVE_INTTYPES_H |
---|
34 | #include <inttypes.h> |
---|
35 | #elif HAVE_STDINT_H |
---|
36 | #include <stdint.h> |
---|
37 | #endif |
---|
38 | #ifdef HAVE_SYS_BITYPES_H |
---|
39 | #include <sys/bitypes.h> |
---|
40 | #endif |
---|
41 | #include <rtems/bsd/sys/types.h> |
---|
42 | #endif /* WIN32 */ |
---|
43 | |
---|
44 | #include "pcap-int.h" |
---|
45 | #include "pcap/usb.h" |
---|
46 | |
---|
47 | #include "pcap-common.h" |
---|
48 | |
---|
49 | /* |
---|
50 | * We don't write DLT_* values to capture files, because they're not the |
---|
51 | * same on all platforms. |
---|
52 | * |
---|
53 | * Unfortunately, the various flavors of BSD have not always used the same |
---|
54 | * numerical values for the same data types, and various patches to |
---|
55 | * libpcap for non-BSD OSes have added their own DLT_* codes for link |
---|
56 | * layer encapsulation types seen on those OSes, and those codes have had, |
---|
57 | * in some cases, values that were also used, on other platforms, for other |
---|
58 | * link layer encapsulation types. |
---|
59 | * |
---|
60 | * This means that capture files of a type whose numerical DLT_* code |
---|
61 | * means different things on different BSDs, or with different versions |
---|
62 | * of libpcap, can't always be read on systems other than those like |
---|
63 | * the one running on the machine on which the capture was made. |
---|
64 | * |
---|
65 | * Instead, we define here a set of LINKTYPE_* codes, and map DLT_* codes |
---|
66 | * to LINKTYPE_* codes when writing a savefile header, and map LINKTYPE_* |
---|
67 | * codes to DLT_* codes when reading a savefile header. |
---|
68 | * |
---|
69 | * For those DLT_* codes that have, as far as we know, the same values on |
---|
70 | * all platforms (DLT_NULL through DLT_FDDI), we define LINKTYPE_xxx as |
---|
71 | * DLT_xxx; that way, captures of those types can still be read by |
---|
72 | * versions of libpcap that map LINKTYPE_* values to DLT_* values, and |
---|
73 | * captures of those types written by versions of libpcap that map DLT_ |
---|
74 | * values to LINKTYPE_ values can still be read by older versions |
---|
75 | * of libpcap. |
---|
76 | * |
---|
77 | * The other LINKTYPE_* codes are given values starting at 100, in the |
---|
78 | * hopes that no DLT_* code will be given one of those values. |
---|
79 | * |
---|
80 | * In order to ensure that a given LINKTYPE_* code's value will refer to |
---|
81 | * the same encapsulation type on all platforms, you should not allocate |
---|
82 | * a new LINKTYPE_* value without consulting |
---|
83 | * "tcpdump-workers@lists.tcpdump.org". The tcpdump developers will |
---|
84 | * allocate a value for you, and will not subsequently allocate it to |
---|
85 | * anybody else; that value will be added to the "pcap.h" in the |
---|
86 | * tcpdump.org Git repository, so that a future libpcap release will |
---|
87 | * include it. |
---|
88 | * |
---|
89 | * You should, if possible, also contribute patches to libpcap and tcpdump |
---|
90 | * to handle the new encapsulation type, so that they can also be checked |
---|
91 | * into the tcpdump.org Git repository and so that they will appear in |
---|
92 | * future libpcap and tcpdump releases. |
---|
93 | * |
---|
94 | * Do *NOT* assume that any values after the largest value in this file |
---|
95 | * are available; you might not have the most up-to-date version of this |
---|
96 | * file, and new values after that one might have been assigned. Also, |
---|
97 | * do *NOT* use any values below 100 - those might already have been |
---|
98 | * taken by one (or more!) organizations. |
---|
99 | * |
---|
100 | * Any platform that defines additional DLT_* codes should: |
---|
101 | * |
---|
102 | * request a LINKTYPE_* code and value from tcpdump.org, |
---|
103 | * as per the above; |
---|
104 | * |
---|
105 | * add, in their version of libpcap, an entry to map |
---|
106 | * those DLT_* codes to the corresponding LINKTYPE_* |
---|
107 | * code; |
---|
108 | * |
---|
109 | * redefine, in their "net/bpf.h", any DLT_* values |
---|
110 | * that collide with the values used by their additional |
---|
111 | * DLT_* codes, to remove those collisions (but without |
---|
112 | * making them collide with any of the LINKTYPE_* |
---|
113 | * values equal to 50 or above; they should also avoid |
---|
114 | * defining DLT_* values that collide with those |
---|
115 | * LINKTYPE_* values, either). |
---|
116 | */ |
---|
117 | #define LINKTYPE_NULL DLT_NULL |
---|
118 | #define LINKTYPE_ETHERNET DLT_EN10MB /* also for 100Mb and up */ |
---|
119 | #define LINKTYPE_EXP_ETHERNET DLT_EN3MB /* 3Mb experimental Ethernet */ |
---|
120 | #define LINKTYPE_AX25 DLT_AX25 |
---|
121 | #define LINKTYPE_PRONET DLT_PRONET |
---|
122 | #define LINKTYPE_CHAOS DLT_CHAOS |
---|
123 | #define LINKTYPE_IEEE802_5 DLT_IEEE802 /* DLT_IEEE802 is used for 802.5 Token Ring */ |
---|
124 | #define LINKTYPE_ARCNET_BSD DLT_ARCNET /* BSD-style headers */ |
---|
125 | #define LINKTYPE_SLIP DLT_SLIP |
---|
126 | #define LINKTYPE_PPP DLT_PPP |
---|
127 | #define LINKTYPE_FDDI DLT_FDDI |
---|
128 | |
---|
129 | /* |
---|
130 | * LINKTYPE_PPP is for use when there might, or might not, be an RFC 1662 |
---|
131 | * PPP in HDLC-like framing header (with 0xff 0x03 before the PPP protocol |
---|
132 | * field) at the beginning of the packet. |
---|
133 | * |
---|
134 | * This is for use when there is always such a header; the address field |
---|
135 | * might be 0xff, for regular PPP, or it might be an address field for Cisco |
---|
136 | * point-to-point with HDLC framing as per section 4.3.1 of RFC 1547 ("Cisco |
---|
137 | * HDLC"). This is, for example, what you get with NetBSD's DLT_PPP_SERIAL. |
---|
138 | * |
---|
139 | * We give it the same value as NetBSD's DLT_PPP_SERIAL, in the hopes that |
---|
140 | * nobody else will choose a DLT_ value of 50, and so that DLT_PPP_SERIAL |
---|
141 | * captures will be written out with a link type that NetBSD's tcpdump |
---|
142 | * can read. |
---|
143 | */ |
---|
144 | #define LINKTYPE_PPP_HDLC 50 /* PPP in HDLC-like framing */ |
---|
145 | |
---|
146 | #define LINKTYPE_PPP_ETHER 51 /* NetBSD PPP-over-Ethernet */ |
---|
147 | |
---|
148 | #define LINKTYPE_SYMANTEC_FIREWALL 99 /* Symantec Enterprise Firewall */ |
---|
149 | |
---|
150 | /* |
---|
151 | * These correspond to DLT_s that have different values on different |
---|
152 | * platforms; we map between these values in capture files and |
---|
153 | * the DLT_ values as returned by pcap_datalink() and passed to |
---|
154 | * pcap_open_dead(). |
---|
155 | */ |
---|
156 | #define LINKTYPE_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */ |
---|
157 | #define LINKTYPE_RAW 101 /* raw IP */ |
---|
158 | #define LINKTYPE_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */ |
---|
159 | #define LINKTYPE_PPP_BSDOS 103 /* BSD/OS PPP BPF header */ |
---|
160 | |
---|
161 | /* |
---|
162 | * Values starting with 104 are used for newly-assigned link-layer |
---|
163 | * header type values; for those link-layer header types, the DLT_ |
---|
164 | * value returned by pcap_datalink() and passed to pcap_open_dead(), |
---|
165 | * and the LINKTYPE_ value that appears in capture files, are the |
---|
166 | * same. |
---|
167 | * |
---|
168 | * LINKTYPE_MATCHING_MIN is the lowest such value; LINKTYPE_MATCHING_MAX |
---|
169 | * is the highest such value. |
---|
170 | */ |
---|
171 | #define LINKTYPE_MATCHING_MIN 104 /* lowest value in the "matching" range */ |
---|
172 | |
---|
173 | #define LINKTYPE_C_HDLC 104 /* Cisco HDLC */ |
---|
174 | #define LINKTYPE_IEEE802_11 105 /* IEEE 802.11 (wireless) */ |
---|
175 | #define LINKTYPE_ATM_CLIP 106 /* Linux Classical IP over ATM */ |
---|
176 | #define LINKTYPE_FRELAY 107 /* Frame Relay */ |
---|
177 | #define LINKTYPE_LOOP 108 /* OpenBSD loopback */ |
---|
178 | #define LINKTYPE_ENC 109 /* OpenBSD IPSEC enc */ |
---|
179 | |
---|
180 | /* |
---|
181 | * These three types are reserved for future use. |
---|
182 | */ |
---|
183 | #define LINKTYPE_LANE8023 110 /* ATM LANE + 802.3 */ |
---|
184 | #define LINKTYPE_HIPPI 111 /* NetBSD HIPPI */ |
---|
185 | #define LINKTYPE_HDLC 112 /* NetBSD HDLC framing */ |
---|
186 | |
---|
187 | #define LINKTYPE_LINUX_SLL 113 /* Linux cooked socket capture */ |
---|
188 | #define LINKTYPE_LTALK 114 /* Apple LocalTalk hardware */ |
---|
189 | #define LINKTYPE_ECONET 115 /* Acorn Econet */ |
---|
190 | |
---|
191 | /* |
---|
192 | * Reserved for use with OpenBSD ipfilter. |
---|
193 | */ |
---|
194 | #define LINKTYPE_IPFILTER 116 |
---|
195 | |
---|
196 | #define LINKTYPE_PFLOG 117 /* OpenBSD DLT_PFLOG */ |
---|
197 | #define LINKTYPE_CISCO_IOS 118 /* For Cisco-internal use */ |
---|
198 | #define LINKTYPE_IEEE802_11_PRISM 119 /* 802.11 plus Prism II monitor mode radio metadata header */ |
---|
199 | #define LINKTYPE_IEEE802_11_AIRONET 120 /* 802.11 plus FreeBSD Aironet driver radio metadata header */ |
---|
200 | |
---|
201 | /* |
---|
202 | * Reserved for Siemens HiPath HDLC. |
---|
203 | */ |
---|
204 | #define LINKTYPE_HHDLC 121 |
---|
205 | |
---|
206 | #define LINKTYPE_IP_OVER_FC 122 /* RFC 2625 IP-over-Fibre Channel */ |
---|
207 | #define LINKTYPE_SUNATM 123 /* Solaris+SunATM */ |
---|
208 | |
---|
209 | /* |
---|
210 | * Reserved as per request from Kent Dahlgren <kent@praesum.com> |
---|
211 | * for private use. |
---|
212 | */ |
---|
213 | #define LINKTYPE_RIO 124 /* RapidIO */ |
---|
214 | #define LINKTYPE_PCI_EXP 125 /* PCI Express */ |
---|
215 | #define LINKTYPE_AURORA 126 /* Xilinx Aurora link layer */ |
---|
216 | |
---|
217 | #define LINKTYPE_IEEE802_11_RADIOTAP 127 /* 802.11 plus radiotap radio metadata header */ |
---|
218 | |
---|
219 | /* |
---|
220 | * Reserved for the TZSP encapsulation, as per request from |
---|
221 | * Chris Waters <chris.waters@networkchemistry.com> |
---|
222 | * TZSP is a generic encapsulation for any other link type, |
---|
223 | * which includes a means to include meta-information |
---|
224 | * with the packet, e.g. signal strength and channel |
---|
225 | * for 802.11 packets. |
---|
226 | */ |
---|
227 | #define LINKTYPE_TZSP 128 /* Tazmen Sniffer Protocol */ |
---|
228 | |
---|
229 | #define LINKTYPE_ARCNET_LINUX 129 /* Linux-style headers */ |
---|
230 | |
---|
231 | /* |
---|
232 | * Juniper-private data link types, as per request from |
---|
233 | * Hannes Gredler <hannes@juniper.net>. The corresponding |
---|
234 | * DLT_s are used for passing on chassis-internal |
---|
235 | * metainformation such as QOS profiles, etc.. |
---|
236 | */ |
---|
237 | #define LINKTYPE_JUNIPER_MLPPP 130 |
---|
238 | #define LINKTYPE_JUNIPER_MLFR 131 |
---|
239 | #define LINKTYPE_JUNIPER_ES 132 |
---|
240 | #define LINKTYPE_JUNIPER_GGSN 133 |
---|
241 | #define LINKTYPE_JUNIPER_MFR 134 |
---|
242 | #define LINKTYPE_JUNIPER_ATM2 135 |
---|
243 | #define LINKTYPE_JUNIPER_SERVICES 136 |
---|
244 | #define LINKTYPE_JUNIPER_ATM1 137 |
---|
245 | |
---|
246 | #define LINKTYPE_APPLE_IP_OVER_IEEE1394 138 /* Apple IP-over-IEEE 1394 cooked header */ |
---|
247 | |
---|
248 | #define LINKTYPE_MTP2_WITH_PHDR 139 |
---|
249 | #define LINKTYPE_MTP2 140 |
---|
250 | #define LINKTYPE_MTP3 141 |
---|
251 | #define LINKTYPE_SCCP 142 |
---|
252 | |
---|
253 | #define LINKTYPE_DOCSIS 143 /* DOCSIS MAC frames */ |
---|
254 | |
---|
255 | #define LINKTYPE_LINUX_IRDA 144 /* Linux-IrDA */ |
---|
256 | |
---|
257 | /* |
---|
258 | * Reserved for IBM SP switch and IBM Next Federation switch. |
---|
259 | */ |
---|
260 | #define LINKTYPE_IBM_SP 145 |
---|
261 | #define LINKTYPE_IBM_SN 146 |
---|
262 | |
---|
263 | /* |
---|
264 | * Reserved for private use. If you have some link-layer header type |
---|
265 | * that you want to use within your organization, with the capture files |
---|
266 | * using that link-layer header type not ever be sent outside your |
---|
267 | * organization, you can use these values. |
---|
268 | * |
---|
269 | * No libpcap release will use these for any purpose, nor will any |
---|
270 | * tcpdump release use them, either. |
---|
271 | * |
---|
272 | * Do *NOT* use these in capture files that you expect anybody not using |
---|
273 | * your private versions of capture-file-reading tools to read; in |
---|
274 | * particular, do *NOT* use them in products, otherwise you may find that |
---|
275 | * people won't be able to use tcpdump, or snort, or Ethereal, or... to |
---|
276 | * read capture files from your firewall/intrusion detection/traffic |
---|
277 | * monitoring/etc. appliance, or whatever product uses that LINKTYPE_ value, |
---|
278 | * and you may also find that the developers of those applications will |
---|
279 | * not accept patches to let them read those files. |
---|
280 | * |
---|
281 | * Also, do not use them if somebody might send you a capture using them |
---|
282 | * for *their* private type and tools using them for *your* private type |
---|
283 | * would have to read them. |
---|
284 | * |
---|
285 | * Instead, in those cases, ask "tcpdump-workers@lists.tcpdump.org" for a |
---|
286 | * new DLT_ and LINKTYPE_ value, as per the comment in pcap/bpf.h, and use |
---|
287 | * the type you're given. |
---|
288 | */ |
---|
289 | #define LINKTYPE_USER0 147 |
---|
290 | #define LINKTYPE_USER1 148 |
---|
291 | #define LINKTYPE_USER2 149 |
---|
292 | #define LINKTYPE_USER3 150 |
---|
293 | #define LINKTYPE_USER4 151 |
---|
294 | #define LINKTYPE_USER5 152 |
---|
295 | #define LINKTYPE_USER6 153 |
---|
296 | #define LINKTYPE_USER7 154 |
---|
297 | #define LINKTYPE_USER8 155 |
---|
298 | #define LINKTYPE_USER9 156 |
---|
299 | #define LINKTYPE_USER10 157 |
---|
300 | #define LINKTYPE_USER11 158 |
---|
301 | #define LINKTYPE_USER12 159 |
---|
302 | #define LINKTYPE_USER13 160 |
---|
303 | #define LINKTYPE_USER14 161 |
---|
304 | #define LINKTYPE_USER15 162 |
---|
305 | |
---|
306 | /* |
---|
307 | * For future use with 802.11 captures - defined by AbsoluteValue |
---|
308 | * Systems to store a number of bits of link-layer information |
---|
309 | * including radio information: |
---|
310 | * |
---|
311 | * http://www.shaftnet.org/~pizza/software/capturefrm.txt |
---|
312 | */ |
---|
313 | #define LINKTYPE_IEEE802_11_AVS 163 /* 802.11 plus AVS radio metadata header */ |
---|
314 | |
---|
315 | /* |
---|
316 | * Juniper-private data link type, as per request from |
---|
317 | * Hannes Gredler <hannes@juniper.net>. The corresponding |
---|
318 | * DLT_s are used for passing on chassis-internal |
---|
319 | * metainformation such as QOS profiles, etc.. |
---|
320 | */ |
---|
321 | #define LINKTYPE_JUNIPER_MONITOR 164 |
---|
322 | |
---|
323 | /* |
---|
324 | * BACnet MS/TP frames. |
---|
325 | */ |
---|
326 | #define LINKTYPE_BACNET_MS_TP 165 |
---|
327 | |
---|
328 | /* |
---|
329 | * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>. |
---|
330 | * |
---|
331 | * This is used in some OSes to allow a kernel socket filter to distinguish |
---|
332 | * between incoming and outgoing packets, on a socket intended to |
---|
333 | * supply pppd with outgoing packets so it can do dial-on-demand and |
---|
334 | * hangup-on-lack-of-demand; incoming packets are filtered out so they |
---|
335 | * don't cause pppd to hold the connection up (you don't want random |
---|
336 | * input packets such as port scans, packets from old lost connections, |
---|
337 | * etc. to force the connection to stay up). |
---|
338 | * |
---|
339 | * The first byte of the PPP header (0xff03) is modified to accomodate |
---|
340 | * the direction - 0x00 = IN, 0x01 = OUT. |
---|
341 | */ |
---|
342 | #define LINKTYPE_PPP_PPPD 166 |
---|
343 | |
---|
344 | /* |
---|
345 | * Juniper-private data link type, as per request from |
---|
346 | * Hannes Gredler <hannes@juniper.net>. The DLT_s are used |
---|
347 | * for passing on chassis-internal metainformation such as |
---|
348 | * QOS profiles, cookies, etc.. |
---|
349 | */ |
---|
350 | #define LINKTYPE_JUNIPER_PPPOE 167 |
---|
351 | #define LINKTYPE_JUNIPER_PPPOE_ATM 168 |
---|
352 | |
---|
353 | #define LINKTYPE_GPRS_LLC 169 /* GPRS LLC */ |
---|
354 | #define LINKTYPE_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */ |
---|
355 | #define LINKTYPE_GPF_F 171 /* GPF-T (ITU-T G.7041/Y.1303) */ |
---|
356 | |
---|
357 | /* |
---|
358 | * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line |
---|
359 | * monitoring equipment. |
---|
360 | */ |
---|
361 | #define LINKTYPE_GCOM_T1E1 172 |
---|
362 | #define LINKTYPE_GCOM_SERIAL 173 |
---|
363 | |
---|
364 | /* |
---|
365 | * Juniper-private data link type, as per request from |
---|
366 | * Hannes Gredler <hannes@juniper.net>. The DLT_ is used |
---|
367 | * for internal communication to Physical Interface Cards (PIC) |
---|
368 | */ |
---|
369 | #define LINKTYPE_JUNIPER_PIC_PEER 174 |
---|
370 | |
---|
371 | /* |
---|
372 | * Link types requested by Gregor Maier <gregor@endace.com> of Endace |
---|
373 | * Measurement Systems. They add an ERF header (see |
---|
374 | * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of |
---|
375 | * the link-layer header. |
---|
376 | */ |
---|
377 | #define LINKTYPE_ERF_ETH 175 /* Ethernet */ |
---|
378 | #define LINKTYPE_ERF_POS 176 /* Packet-over-SONET */ |
---|
379 | |
---|
380 | /* |
---|
381 | * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD |
---|
382 | * for vISDN (http://www.orlandi.com/visdn/). Its link-layer header |
---|
383 | * includes additional information before the LAPD header, so it's |
---|
384 | * not necessarily a generic LAPD header. |
---|
385 | */ |
---|
386 | #define LINKTYPE_LINUX_LAPD 177 |
---|
387 | |
---|
388 | /* |
---|
389 | * Juniper-private data link type, as per request from |
---|
390 | * Hannes Gredler <hannes@juniper.net>. |
---|
391 | * The Link Types are used for prepending meta-information |
---|
392 | * like interface index, interface name |
---|
393 | * before standard Ethernet, PPP, Frelay & C-HDLC Frames |
---|
394 | */ |
---|
395 | #define LINKTYPE_JUNIPER_ETHER 178 |
---|
396 | #define LINKTYPE_JUNIPER_PPP 179 |
---|
397 | #define LINKTYPE_JUNIPER_FRELAY 180 |
---|
398 | #define LINKTYPE_JUNIPER_CHDLC 181 |
---|
399 | |
---|
400 | /* |
---|
401 | * Multi Link Frame Relay (FRF.16) |
---|
402 | */ |
---|
403 | #define LINKTYPE_MFR 182 |
---|
404 | |
---|
405 | /* |
---|
406 | * Juniper-private data link type, as per request from |
---|
407 | * Hannes Gredler <hannes@juniper.net>. |
---|
408 | * The DLT_ is used for internal communication with a |
---|
409 | * voice Adapter Card (PIC) |
---|
410 | */ |
---|
411 | #define LINKTYPE_JUNIPER_VP 183 |
---|
412 | |
---|
413 | /* |
---|
414 | * Arinc 429 frames. |
---|
415 | * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. |
---|
416 | * Every frame contains a 32bit A429 label. |
---|
417 | * More documentation on Arinc 429 can be found at |
---|
418 | * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf |
---|
419 | */ |
---|
420 | #define LINKTYPE_A429 184 |
---|
421 | |
---|
422 | /* |
---|
423 | * Arinc 653 Interpartition Communication messages. |
---|
424 | * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. |
---|
425 | * Please refer to the A653-1 standard for more information. |
---|
426 | */ |
---|
427 | #define LINKTYPE_A653_ICM 185 |
---|
428 | |
---|
429 | /* |
---|
430 | * USB packets, beginning with a USB setup header; requested by |
---|
431 | * Paolo Abeni <paolo.abeni@email.it>. |
---|
432 | */ |
---|
433 | #define LINKTYPE_USB 186 |
---|
434 | |
---|
435 | /* |
---|
436 | * Bluetooth HCI UART transport layer (part H:4); requested by |
---|
437 | * Paolo Abeni. |
---|
438 | */ |
---|
439 | #define LINKTYPE_BLUETOOTH_HCI_H4 187 |
---|
440 | |
---|
441 | /* |
---|
442 | * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz |
---|
443 | * <cruz_petagay@bah.com>. |
---|
444 | */ |
---|
445 | #define LINKTYPE_IEEE802_16_MAC_CPS 188 |
---|
446 | |
---|
447 | /* |
---|
448 | * USB packets, beginning with a Linux USB header; requested by |
---|
449 | * Paolo Abeni <paolo.abeni@email.it>. |
---|
450 | */ |
---|
451 | #define LINKTYPE_USB_LINUX 189 |
---|
452 | |
---|
453 | /* |
---|
454 | * Controller Area Network (CAN) v. 2.0B packets. |
---|
455 | * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. |
---|
456 | * Used to dump CAN packets coming from a CAN Vector board. |
---|
457 | * More documentation on the CAN v2.0B frames can be found at |
---|
458 | * http://www.can-cia.org/downloads/?269 |
---|
459 | */ |
---|
460 | #define LINKTYPE_CAN20B 190 |
---|
461 | |
---|
462 | /* |
---|
463 | * IEEE 802.15.4, with address fields padded, as is done by Linux |
---|
464 | * drivers; requested by Juergen Schimmer. |
---|
465 | */ |
---|
466 | #define LINKTYPE_IEEE802_15_4_LINUX 191 |
---|
467 | |
---|
468 | /* |
---|
469 | * Per Packet Information encapsulated packets. |
---|
470 | * LINKTYPE_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. |
---|
471 | */ |
---|
472 | #define LINKTYPE_PPI 192 |
---|
473 | |
---|
474 | /* |
---|
475 | * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header; |
---|
476 | * requested by Charles Clancy. |
---|
477 | */ |
---|
478 | #define LINKTYPE_IEEE802_16_MAC_CPS_RADIO 193 |
---|
479 | |
---|
480 | /* |
---|
481 | * Juniper-private data link type, as per request from |
---|
482 | * Hannes Gredler <hannes@juniper.net>. |
---|
483 | * The DLT_ is used for internal communication with a |
---|
484 | * integrated service module (ISM). |
---|
485 | */ |
---|
486 | #define LINKTYPE_JUNIPER_ISM 194 |
---|
487 | |
---|
488 | /* |
---|
489 | * IEEE 802.15.4, exactly as it appears in the spec (no padding, no |
---|
490 | * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>. |
---|
491 | */ |
---|
492 | #define LINKTYPE_IEEE802_15_4 195 |
---|
493 | |
---|
494 | /* |
---|
495 | * Various link-layer types, with a pseudo-header, for SITA |
---|
496 | * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com). |
---|
497 | */ |
---|
498 | #define LINKTYPE_SITA 196 |
---|
499 | |
---|
500 | /* |
---|
501 | * Various link-layer types, with a pseudo-header, for Endace DAG cards; |
---|
502 | * encapsulates Endace ERF records. Requested by Stephen Donnelly |
---|
503 | * <stephen@endace.com>. |
---|
504 | */ |
---|
505 | #define LINKTYPE_ERF 197 |
---|
506 | |
---|
507 | /* |
---|
508 | * Special header prepended to Ethernet packets when capturing from a |
---|
509 | * u10 Networks board. Requested by Phil Mulholland |
---|
510 | * <phil@u10networks.com>. |
---|
511 | */ |
---|
512 | #define LINKTYPE_RAIF1 198 |
---|
513 | |
---|
514 | /* |
---|
515 | * IPMB packet for IPMI, beginning with the I2C slave address, followed |
---|
516 | * by the netFn and LUN, etc.. Requested by Chanthy Toeung |
---|
517 | * <chanthy.toeung@ca.kontron.com>. |
---|
518 | */ |
---|
519 | #define LINKTYPE_IPMB 199 |
---|
520 | |
---|
521 | /* |
---|
522 | * Juniper-private data link type, as per request from |
---|
523 | * Hannes Gredler <hannes@juniper.net>. |
---|
524 | * The DLT_ is used for capturing data on a secure tunnel interface. |
---|
525 | */ |
---|
526 | #define LINKTYPE_JUNIPER_ST 200 |
---|
527 | |
---|
528 | /* |
---|
529 | * Bluetooth HCI UART transport layer (part H:4), with pseudo-header |
---|
530 | * that includes direction information; requested by Paolo Abeni. |
---|
531 | */ |
---|
532 | #define LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR 201 |
---|
533 | |
---|
534 | /* |
---|
535 | * AX.25 packet with a 1-byte KISS header; see |
---|
536 | * |
---|
537 | * http://www.ax25.net/kiss.htm |
---|
538 | * |
---|
539 | * as per Richard Stearn <richard@rns-stearn.demon.co.uk>. |
---|
540 | */ |
---|
541 | #define LINKTYPE_AX25_KISS 202 |
---|
542 | |
---|
543 | /* |
---|
544 | * LAPD packets from an ISDN channel, starting with the address field, |
---|
545 | * with no pseudo-header. |
---|
546 | * Requested by Varuna De Silva <varunax@gmail.com>. |
---|
547 | */ |
---|
548 | #define LINKTYPE_LAPD 203 |
---|
549 | |
---|
550 | /* |
---|
551 | * Variants of various link-layer headers, with a one-byte direction |
---|
552 | * pseudo-header prepended - zero means "received by this host", |
---|
553 | * non-zero (any non-zero value) means "sent by this host" - as per |
---|
554 | * Will Barker <w.barker@zen.co.uk>. |
---|
555 | */ |
---|
556 | #define LINKTYPE_PPP_WITH_DIR 204 /* PPP */ |
---|
557 | #define LINKTYPE_C_HDLC_WITH_DIR 205 /* Cisco HDLC */ |
---|
558 | #define LINKTYPE_FRELAY_WITH_DIR 206 /* Frame Relay */ |
---|
559 | #define LINKTYPE_LAPB_WITH_DIR 207 /* LAPB */ |
---|
560 | |
---|
561 | /* |
---|
562 | * 208 is reserved for an as-yet-unspecified proprietary link-layer |
---|
563 | * type, as requested by Will Barker. |
---|
564 | */ |
---|
565 | |
---|
566 | /* |
---|
567 | * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman |
---|
568 | * <avn@pigeonpoint.com>. |
---|
569 | */ |
---|
570 | #define LINKTYPE_IPMB_LINUX 209 |
---|
571 | |
---|
572 | /* |
---|
573 | * FlexRay automotive bus - http://www.flexray.com/ - as requested |
---|
574 | * by Hannes Kaelber <hannes.kaelber@x2e.de>. |
---|
575 | */ |
---|
576 | #define LINKTYPE_FLEXRAY 210 |
---|
577 | |
---|
578 | /* |
---|
579 | * Media Oriented Systems Transport (MOST) bus for multimedia |
---|
580 | * transport - http://www.mostcooperation.com/ - as requested |
---|
581 | * by Hannes Kaelber <hannes.kaelber@x2e.de>. |
---|
582 | */ |
---|
583 | #define LINKTYPE_MOST 211 |
---|
584 | |
---|
585 | /* |
---|
586 | * Local Interconnect Network (LIN) bus for vehicle networks - |
---|
587 | * http://www.lin-subbus.org/ - as requested by Hannes Kaelber |
---|
588 | * <hannes.kaelber@x2e.de>. |
---|
589 | */ |
---|
590 | #define LINKTYPE_LIN 212 |
---|
591 | |
---|
592 | /* |
---|
593 | * X2E-private data link type used for serial line capture, |
---|
594 | * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>. |
---|
595 | */ |
---|
596 | #define LINKTYPE_X2E_SERIAL 213 |
---|
597 | |
---|
598 | /* |
---|
599 | * X2E-private data link type used for the Xoraya data logger |
---|
600 | * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>. |
---|
601 | */ |
---|
602 | #define LINKTYPE_X2E_XORAYA 214 |
---|
603 | |
---|
604 | /* |
---|
605 | * IEEE 802.15.4, exactly as it appears in the spec (no padding, no |
---|
606 | * nothing), but with the PHY-level data for non-ASK PHYs (4 octets |
---|
607 | * of 0 as preamble, one octet of SFD, one octet of frame length+ |
---|
608 | * reserved bit, and then the MAC-layer data, starting with the |
---|
609 | * frame control field). |
---|
610 | * |
---|
611 | * Requested by Max Filippov <jcmvbkbc@gmail.com>. |
---|
612 | */ |
---|
613 | #define LINKTYPE_IEEE802_15_4_NONASK_PHY 215 |
---|
614 | |
---|
615 | /* |
---|
616 | * David Gibson <david@gibson.dropbear.id.au> requested this for |
---|
617 | * captures from the Linux kernel /dev/input/eventN devices. This |
---|
618 | * is used to communicate keystrokes and mouse movements from the |
---|
619 | * Linux kernel to display systems, such as Xorg. |
---|
620 | */ |
---|
621 | #define LINKTYPE_LINUX_EVDEV 216 |
---|
622 | |
---|
623 | /* |
---|
624 | * GSM Um and Abis interfaces, preceded by a "gsmtap" header. |
---|
625 | * |
---|
626 | * Requested by Harald Welte <laforge@gnumonks.org>. |
---|
627 | */ |
---|
628 | #define LINKTYPE_GSMTAP_UM 217 |
---|
629 | #define LINKTYPE_GSMTAP_ABIS 218 |
---|
630 | |
---|
631 | /* |
---|
632 | * MPLS, with an MPLS label as the link-layer header. |
---|
633 | * Requested by Michele Marchetto <michele@openbsd.org> on behalf |
---|
634 | * of OpenBSD. |
---|
635 | */ |
---|
636 | #define LINKTYPE_MPLS 219 |
---|
637 | |
---|
638 | /* |
---|
639 | * USB packets, beginning with a Linux USB header, with the USB header |
---|
640 | * padded to 64 bytes; required for memory-mapped access. |
---|
641 | */ |
---|
642 | #define LINKTYPE_USB_LINUX_MMAPPED 220 |
---|
643 | |
---|
644 | /* |
---|
645 | * DECT packets, with a pseudo-header; requested by |
---|
646 | * Matthias Wenzel <tcpdump@mazzoo.de>. |
---|
647 | */ |
---|
648 | #define LINKTYPE_DECT 221 |
---|
649 | |
---|
650 | /* |
---|
651 | * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov> |
---|
652 | * Date: Mon, 11 May 2009 11:18:30 -0500 |
---|
653 | * |
---|
654 | * DLT_AOS. We need it for AOS Space Data Link Protocol. |
---|
655 | * I have already written dissectors for but need an OK from |
---|
656 | * legal before I can submit a patch. |
---|
657 | * |
---|
658 | */ |
---|
659 | #define LINKTYPE_AOS 222 |
---|
660 | |
---|
661 | /* |
---|
662 | * Wireless HART (Highway Addressable Remote Transducer) |
---|
663 | * From the HART Communication Foundation |
---|
664 | * IES/PAS 62591 |
---|
665 | * |
---|
666 | * Requested by Sam Roberts <vieuxtech@gmail.com>. |
---|
667 | */ |
---|
668 | #define LINKTYPE_WIHART 223 |
---|
669 | |
---|
670 | /* |
---|
671 | * Fibre Channel FC-2 frames, beginning with a Frame_Header. |
---|
672 | * Requested by Kahou Lei <kahou82@gmail.com>. |
---|
673 | */ |
---|
674 | #define LINKTYPE_FC_2 224 |
---|
675 | |
---|
676 | /* |
---|
677 | * Fibre Channel FC-2 frames, beginning with an encoding of the |
---|
678 | * SOF, and ending with an encoding of the EOF. |
---|
679 | * |
---|
680 | * The encodings represent the frame delimiters as 4-byte sequences |
---|
681 | * representing the corresponding ordered sets, with K28.5 |
---|
682 | * represented as 0xBC, and the D symbols as the corresponding |
---|
683 | * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2, |
---|
684 | * is represented as 0xBC 0xB5 0x55 0x55. |
---|
685 | * |
---|
686 | * Requested by Kahou Lei <kahou82@gmail.com>. |
---|
687 | */ |
---|
688 | #define LINKTYPE_FC_2_WITH_FRAME_DELIMS 225 |
---|
689 | |
---|
690 | /* |
---|
691 | * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>. |
---|
692 | * |
---|
693 | * The pseudo-header starts with a one-byte version number; for version 2, |
---|
694 | * the pseudo-header is: |
---|
695 | * |
---|
696 | * struct dl_ipnetinfo { |
---|
697 | * u_int8_t dli_version; |
---|
698 | * u_int8_t dli_family; |
---|
699 | * u_int16_t dli_htype; |
---|
700 | * u_int32_t dli_pktlen; |
---|
701 | * u_int32_t dli_ifindex; |
---|
702 | * u_int32_t dli_grifindex; |
---|
703 | * u_int32_t dli_zsrc; |
---|
704 | * u_int32_t dli_zdst; |
---|
705 | * }; |
---|
706 | * |
---|
707 | * dli_version is 2 for the current version of the pseudo-header. |
---|
708 | * |
---|
709 | * dli_family is a Solaris address family value, so it's 2 for IPv4 |
---|
710 | * and 26 for IPv6. |
---|
711 | * |
---|
712 | * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing |
---|
713 | * packets, and 2 for packets arriving from another zone on the same |
---|
714 | * machine. |
---|
715 | * |
---|
716 | * dli_pktlen is the length of the packet data following the pseudo-header |
---|
717 | * (so the captured length minus dli_pktlen is the length of the |
---|
718 | * pseudo-header, assuming the entire pseudo-header was captured). |
---|
719 | * |
---|
720 | * dli_ifindex is the interface index of the interface on which the |
---|
721 | * packet arrived. |
---|
722 | * |
---|
723 | * dli_grifindex is the group interface index number (for IPMP interfaces). |
---|
724 | * |
---|
725 | * dli_zsrc is the zone identifier for the source of the packet. |
---|
726 | * |
---|
727 | * dli_zdst is the zone identifier for the destination of the packet. |
---|
728 | * |
---|
729 | * A zone number of 0 is the global zone; a zone number of 0xffffffff |
---|
730 | * means that the packet arrived from another host on the network, not |
---|
731 | * from another zone on the same machine. |
---|
732 | * |
---|
733 | * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates |
---|
734 | * which of those it is. |
---|
735 | */ |
---|
736 | #define LINKTYPE_IPNET 226 |
---|
737 | |
---|
738 | /* |
---|
739 | * CAN (Controller Area Network) frames, with a pseudo-header as supplied |
---|
740 | * by Linux SocketCAN. See Documentation/networking/can.txt in the Linux |
---|
741 | * source. |
---|
742 | * |
---|
743 | * Requested by Felix Obenhuber <felix@obenhuber.de>. |
---|
744 | */ |
---|
745 | #define LINKTYPE_CAN_SOCKETCAN 227 |
---|
746 | |
---|
747 | /* |
---|
748 | * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies |
---|
749 | * whether it's v4 or v6. Requested by Darren Reed <Darren.Reed@Sun.COM>. |
---|
750 | */ |
---|
751 | #define LINKTYPE_IPV4 228 |
---|
752 | #define LINKTYPE_IPV6 229 |
---|
753 | |
---|
754 | /* |
---|
755 | * IEEE 802.15.4, exactly as it appears in the spec (no padding, no |
---|
756 | * nothing), and with no FCS at the end of the frame; requested by |
---|
757 | * Jon Smirl <jonsmirl@gmail.com>. |
---|
758 | */ |
---|
759 | #define LINKTYPE_IEEE802_15_4_NOFCS 230 |
---|
760 | |
---|
761 | /* |
---|
762 | * Raw D-Bus: |
---|
763 | * |
---|
764 | * http://www.freedesktop.org/wiki/Software/dbus |
---|
765 | * |
---|
766 | * messages: |
---|
767 | * |
---|
768 | * http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages |
---|
769 | * |
---|
770 | * starting with the endianness flag, followed by the message type, etc., |
---|
771 | * but without the authentication handshake before the message sequence: |
---|
772 | * |
---|
773 | * http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol |
---|
774 | * |
---|
775 | * Requested by Martin Vidner <martin@vidner.net>. |
---|
776 | */ |
---|
777 | #define LINKTYPE_DBUS 231 |
---|
778 | |
---|
779 | /* |
---|
780 | * Juniper-private data link type, as per request from |
---|
781 | * Hannes Gredler <hannes@juniper.net>. |
---|
782 | */ |
---|
783 | #define LINKTYPE_JUNIPER_VS 232 |
---|
784 | #define LINKTYPE_JUNIPER_SRX_E2E 233 |
---|
785 | #define LINKTYPE_JUNIPER_FIBRECHANNEL 234 |
---|
786 | |
---|
787 | /* |
---|
788 | * DVB-CI (DVB Common Interface for communication between a PC Card |
---|
789 | * module and a DVB receiver). See |
---|
790 | * |
---|
791 | * http://www.kaiser.cx/pcap-dvbci.html |
---|
792 | * |
---|
793 | * for the specification. |
---|
794 | * |
---|
795 | * Requested by Martin Kaiser <martin@kaiser.cx>. |
---|
796 | */ |
---|
797 | #define LINKTYPE_DVB_CI 235 |
---|
798 | |
---|
799 | /* |
---|
800 | * Variant of 3GPP TS 27.010 multiplexing protocol. Requested |
---|
801 | * by Hans-Christoph Schemmel <hans-christoph.schemmel@cinterion.com>. |
---|
802 | */ |
---|
803 | #define LINKTYPE_MUX27010 236 |
---|
804 | |
---|
805 | /* |
---|
806 | * STANAG 5066 D_PDUs. Requested by M. Baris Demiray |
---|
807 | * <barisdemiray@gmail.com>. |
---|
808 | */ |
---|
809 | #define LINKTYPE_STANAG_5066_D_PDU 237 |
---|
810 | |
---|
811 | /* |
---|
812 | * Juniper-private data link type, as per request from |
---|
813 | * Hannes Gredler <hannes@juniper.net>. |
---|
814 | */ |
---|
815 | #define LINKTYPE_JUNIPER_ATM_CEMIC 238 |
---|
816 | |
---|
817 | /* |
---|
818 | * NetFilter LOG messages |
---|
819 | * (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets) |
---|
820 | * |
---|
821 | * Requested by Jakub Zawadzki <darkjames-ws@darkjames.pl> |
---|
822 | */ |
---|
823 | #define LINKTYPE_NFLOG 239 |
---|
824 | |
---|
825 | /* |
---|
826 | * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type |
---|
827 | * for Ethernet packets with a 4-byte pseudo-header and always |
---|
828 | * with the payload including the FCS, as supplied by their |
---|
829 | * netANALYZER hardware and software. |
---|
830 | * |
---|
831 | * Requested by Holger P. Frommer <HPfrommer@hilscher.com> |
---|
832 | */ |
---|
833 | #define LINKTYPE_NETANALYZER 240 |
---|
834 | |
---|
835 | /* |
---|
836 | * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type |
---|
837 | * for Ethernet packets with a 4-byte pseudo-header and FCS and |
---|
838 | * 1 byte of SFD, as supplied by their netANALYZER hardware and |
---|
839 | * software. |
---|
840 | * |
---|
841 | * Requested by Holger P. Frommer <HPfrommer@hilscher.com> |
---|
842 | */ |
---|
843 | #define LINKTYPE_NETANALYZER_TRANSPARENT 241 |
---|
844 | |
---|
845 | /* |
---|
846 | * IP-over-InfiniBand, as specified by RFC 4391. |
---|
847 | * |
---|
848 | * Requested by Petr Sumbera <petr.sumbera@oracle.com>. |
---|
849 | */ |
---|
850 | #define LINKTYPE_IPOIB 242 |
---|
851 | |
---|
852 | /* |
---|
853 | * MPEG-2 transport stream (ISO 13818-1/ITU-T H.222.0). |
---|
854 | * |
---|
855 | * Requested by Guy Martin <gmsoft@tuxicoman.be>. |
---|
856 | */ |
---|
857 | #define LINKTYPE_MPEG_2_TS 243 |
---|
858 | |
---|
859 | /* |
---|
860 | * ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as |
---|
861 | * used by their ng40 protocol tester. |
---|
862 | * |
---|
863 | * Requested by Jens Grimmer <jens.grimmer@ng4t.com>. |
---|
864 | */ |
---|
865 | #define LINKTYPE_NG40 244 |
---|
866 | |
---|
867 | /* |
---|
868 | * Pseudo-header giving adapter number and flags, followed by an NFC |
---|
869 | * (Near-Field Communications) Logical Link Control Protocol (LLCP) PDU, |
---|
870 | * as specified by NFC Forum Logical Link Control Protocol Technical |
---|
871 | * Specification LLCP 1.1. |
---|
872 | * |
---|
873 | * Requested by Mike Wakerly <mikey@google.com>. |
---|
874 | */ |
---|
875 | #define LINKTYPE_NFC_LLCP 245 |
---|
876 | |
---|
877 | /* |
---|
878 | * pfsync output; DLT_PFSYNC is 18, which collides with DLT_CIP in |
---|
879 | * SuSE 6.3, on OpenBSD, NetBSD, DragonFly BSD, and Mac OS X, and |
---|
880 | * is 121, which collides with DLT_HHDLC, in FreeBSD. We pick a |
---|
881 | * shiny new link-layer header type value that doesn't collide with |
---|
882 | * anything, in the hopes that future pfsync savefiles, if any, |
---|
883 | * won't require special hacks to distinguish from other savefiles. |
---|
884 | * |
---|
885 | */ |
---|
886 | #define LINKTYPE_PFSYNC 246 |
---|
887 | |
---|
888 | /* |
---|
889 | * Raw InfiniBand packets, starting with the Local Routing Header. |
---|
890 | * |
---|
891 | * Requested by Oren Kladnitsky <orenk@mellanox.com>. |
---|
892 | */ |
---|
893 | #define LINKTYPE_INFINIBAND 247 |
---|
894 | |
---|
895 | /* |
---|
896 | * SCTP, with no lower-level protocols (i.e., no IPv4 or IPv6). |
---|
897 | * |
---|
898 | * Requested by Michael Tuexen <Michael.Tuexen@lurchi.franken.de>. |
---|
899 | */ |
---|
900 | #define LINKTYPE_SCTP 248 |
---|
901 | |
---|
902 | #define LINKTYPE_MATCHING_MAX 248 /* highest value in the "matching" range */ |
---|
903 | |
---|
904 | static struct linktype_map { |
---|
905 | int dlt; |
---|
906 | int linktype; |
---|
907 | } map[] = { |
---|
908 | /* |
---|
909 | * These DLT_* codes have LINKTYPE_* codes with values identical |
---|
910 | * to the values of the corresponding DLT_* code. |
---|
911 | */ |
---|
912 | { DLT_NULL, LINKTYPE_NULL }, |
---|
913 | { DLT_EN10MB, LINKTYPE_ETHERNET }, |
---|
914 | { DLT_EN3MB, LINKTYPE_EXP_ETHERNET }, |
---|
915 | { DLT_AX25, LINKTYPE_AX25 }, |
---|
916 | { DLT_PRONET, LINKTYPE_PRONET }, |
---|
917 | { DLT_CHAOS, LINKTYPE_CHAOS }, |
---|
918 | { DLT_IEEE802, LINKTYPE_IEEE802_5 }, |
---|
919 | { DLT_ARCNET, LINKTYPE_ARCNET_BSD }, |
---|
920 | { DLT_SLIP, LINKTYPE_SLIP }, |
---|
921 | { DLT_PPP, LINKTYPE_PPP }, |
---|
922 | { DLT_FDDI, LINKTYPE_FDDI }, |
---|
923 | { DLT_SYMANTEC_FIREWALL, LINKTYPE_SYMANTEC_FIREWALL }, |
---|
924 | |
---|
925 | /* |
---|
926 | * These DLT_* codes have different values on different |
---|
927 | * platforms; we map them to LINKTYPE_* codes that |
---|
928 | * have values that should never be equal to any DLT_* |
---|
929 | * code. |
---|
930 | */ |
---|
931 | #ifdef DLT_FR |
---|
932 | /* BSD/OS Frame Relay */ |
---|
933 | { DLT_FR, LINKTYPE_FRELAY }, |
---|
934 | #endif |
---|
935 | |
---|
936 | { DLT_ATM_RFC1483, LINKTYPE_ATM_RFC1483 }, |
---|
937 | { DLT_RAW, LINKTYPE_RAW }, |
---|
938 | { DLT_SLIP_BSDOS, LINKTYPE_SLIP_BSDOS }, |
---|
939 | { DLT_PPP_BSDOS, LINKTYPE_PPP_BSDOS }, |
---|
940 | |
---|
941 | /* BSD/OS Cisco HDLC */ |
---|
942 | { DLT_C_HDLC, LINKTYPE_C_HDLC }, |
---|
943 | |
---|
944 | /* |
---|
945 | * These DLT_* codes are not on all platforms, but, so far, |
---|
946 | * there don't appear to be any platforms that define |
---|
947 | * other codes with those values; we map them to |
---|
948 | * different LINKTYPE_* values anyway, just in case. |
---|
949 | */ |
---|
950 | |
---|
951 | /* Linux ATM Classical IP */ |
---|
952 | { DLT_ATM_CLIP, LINKTYPE_ATM_CLIP }, |
---|
953 | |
---|
954 | /* NetBSD sync/async serial PPP (or Cisco HDLC) */ |
---|
955 | { DLT_PPP_SERIAL, LINKTYPE_PPP_HDLC }, |
---|
956 | |
---|
957 | /* NetBSD PPP over Ethernet */ |
---|
958 | { DLT_PPP_ETHER, LINKTYPE_PPP_ETHER }, |
---|
959 | |
---|
960 | /* |
---|
961 | * All LINKTYPE_ values between LINKTYPE_MATCHING_MIN |
---|
962 | * and LINKTYPE_MATCHING_MAX are mapped to identical |
---|
963 | * DLT_ values. |
---|
964 | */ |
---|
965 | |
---|
966 | { -1, -1 } |
---|
967 | }; |
---|
968 | |
---|
969 | int |
---|
970 | dlt_to_linktype(int dlt) |
---|
971 | { |
---|
972 | int i; |
---|
973 | |
---|
974 | /* |
---|
975 | * Map DLT_PFSYNC, whatever it might be, to LINKTYPE_PFSYNC. |
---|
976 | */ |
---|
977 | if (dlt == DLT_PFSYNC) |
---|
978 | return (LINKTYPE_PFSYNC); |
---|
979 | |
---|
980 | /* |
---|
981 | * Map the values in the matching range. |
---|
982 | */ |
---|
983 | if (dlt >= DLT_MATCHING_MIN && dlt <= DLT_MATCHING_MAX) |
---|
984 | return (dlt); |
---|
985 | |
---|
986 | /* |
---|
987 | * Map the values outside that range. |
---|
988 | */ |
---|
989 | for (i = 0; map[i].dlt != -1; i++) { |
---|
990 | if (map[i].dlt == dlt) |
---|
991 | return (map[i].linktype); |
---|
992 | } |
---|
993 | |
---|
994 | /* |
---|
995 | * If we don't have a mapping for this DLT_ code, return an |
---|
996 | * error; that means that this is a value with no corresponding |
---|
997 | * LINKTYPE_ code, and we need to assign one. |
---|
998 | */ |
---|
999 | return (-1); |
---|
1000 | } |
---|
1001 | |
---|
1002 | int |
---|
1003 | linktype_to_dlt(int linktype) |
---|
1004 | { |
---|
1005 | int i; |
---|
1006 | |
---|
1007 | /* |
---|
1008 | * Map LINKTYPE_PFSYNC to DLT_PFSYNC, whatever it might be. |
---|
1009 | * LINKTYPE_PFSYNC is in the matching range, to make sure |
---|
1010 | * it's as safe from reuse as we can arrange, so we do |
---|
1011 | * this test first. |
---|
1012 | */ |
---|
1013 | if (linktype == LINKTYPE_PFSYNC) |
---|
1014 | return (DLT_PFSYNC); |
---|
1015 | |
---|
1016 | /* |
---|
1017 | * Map the values in the matching range. |
---|
1018 | */ |
---|
1019 | if (linktype >= LINKTYPE_MATCHING_MIN && |
---|
1020 | linktype <= LINKTYPE_MATCHING_MAX) |
---|
1021 | return (linktype); |
---|
1022 | |
---|
1023 | /* |
---|
1024 | * Map the values outside that range. |
---|
1025 | */ |
---|
1026 | for (i = 0; map[i].linktype != -1; i++) { |
---|
1027 | if (map[i].linktype == linktype) |
---|
1028 | return (map[i].dlt); |
---|
1029 | } |
---|
1030 | |
---|
1031 | /* |
---|
1032 | * If we don't have an entry for this link type, return |
---|
1033 | * the link type value; it may be a DLT_ value from an |
---|
1034 | * older version of libpcap. |
---|
1035 | */ |
---|
1036 | return linktype; |
---|
1037 | } |
---|
1038 | |
---|
1039 | /* |
---|
1040 | * The DLT_USB_LINUX and DLT_USB_LINUX_MMAPPED headers are in host |
---|
1041 | * byte order when capturing (it's supplied directly from a |
---|
1042 | * memory-mapped buffer shared by the kernel). |
---|
1043 | * |
---|
1044 | * When reading a DLT_USB_LINUX or DLT_USB_LINUX_MMAPPED capture file, |
---|
1045 | * we need to convert it from the capturing host's byte order to |
---|
1046 | * the reading host's byte order. |
---|
1047 | */ |
---|
1048 | void |
---|
1049 | swap_linux_usb_header(const struct pcap_pkthdr *hdr, u_char *buf, |
---|
1050 | int header_len_64_bytes) |
---|
1051 | { |
---|
1052 | pcap_usb_header_mmapped *uhdr = (pcap_usb_header_mmapped *)buf; |
---|
1053 | bpf_u_int32 offset = 0; |
---|
1054 | usb_isodesc *pisodesc; |
---|
1055 | int32_t numdesc, i; |
---|
1056 | |
---|
1057 | /* |
---|
1058 | * "offset" is the offset *past* the field we're swapping; |
---|
1059 | * we skip the field *before* checking to make sure |
---|
1060 | * the captured data length includes the entire field. |
---|
1061 | */ |
---|
1062 | |
---|
1063 | /* |
---|
1064 | * The URB id is a totally opaque value; do we really need to |
---|
1065 | * convert it to the reading host's byte order??? |
---|
1066 | */ |
---|
1067 | offset += 8; /* skip past id */ |
---|
1068 | if (hdr->caplen < offset) |
---|
1069 | return; |
---|
1070 | uhdr->id = SWAPLL(uhdr->id); |
---|
1071 | |
---|
1072 | offset += 4; /* skip past various 1-byte fields */ |
---|
1073 | |
---|
1074 | offset += 2; /* skip past bus_id */ |
---|
1075 | if (hdr->caplen < offset) |
---|
1076 | return; |
---|
1077 | uhdr->bus_id = SWAPSHORT(uhdr->bus_id); |
---|
1078 | |
---|
1079 | offset += 2; /* skip past various 1-byte fields */ |
---|
1080 | |
---|
1081 | offset += 8; /* skip past ts_sec */ |
---|
1082 | if (hdr->caplen < offset) |
---|
1083 | return; |
---|
1084 | uhdr->ts_sec = SWAPLL(uhdr->ts_sec); |
---|
1085 | |
---|
1086 | offset += 4; /* skip past ts_usec */ |
---|
1087 | if (hdr->caplen < offset) |
---|
1088 | return; |
---|
1089 | uhdr->ts_usec = SWAPLONG(uhdr->ts_usec); |
---|
1090 | |
---|
1091 | offset += 4; /* skip past status */ |
---|
1092 | if (hdr->caplen < offset) |
---|
1093 | return; |
---|
1094 | uhdr->status = SWAPLONG(uhdr->status); |
---|
1095 | |
---|
1096 | offset += 4; /* skip past urb_len */ |
---|
1097 | if (hdr->caplen < offset) |
---|
1098 | return; |
---|
1099 | uhdr->urb_len = SWAPLONG(uhdr->urb_len); |
---|
1100 | |
---|
1101 | offset += 4; /* skip past data_len */ |
---|
1102 | if (hdr->caplen < offset) |
---|
1103 | return; |
---|
1104 | uhdr->data_len = SWAPLONG(uhdr->data_len); |
---|
1105 | |
---|
1106 | if (uhdr->transfer_type == URB_ISOCHRONOUS) { |
---|
1107 | offset += 4; /* skip past s.iso.error_count */ |
---|
1108 | if (hdr->caplen < offset) |
---|
1109 | return; |
---|
1110 | uhdr->s.iso.error_count = SWAPLONG(uhdr->s.iso.error_count); |
---|
1111 | |
---|
1112 | offset += 4; /* skip past s.iso.numdesc */ |
---|
1113 | if (hdr->caplen < offset) |
---|
1114 | return; |
---|
1115 | uhdr->s.iso.numdesc = SWAPLONG(uhdr->s.iso.numdesc); |
---|
1116 | } else |
---|
1117 | offset += 8; /* skip USB setup header */ |
---|
1118 | |
---|
1119 | if (header_len_64_bytes) { |
---|
1120 | /* |
---|
1121 | * This is either the "version 1" header, with |
---|
1122 | * 16 bytes of additional fields at the end, or |
---|
1123 | * a "version 0" header from a memory-mapped |
---|
1124 | * capture, with 16 bytes of zeroed-out padding |
---|
1125 | * at the end. Byte swap them as if this were |
---|
1126 | * a "version 1" header. |
---|
1127 | */ |
---|
1128 | offset += 4; /* skip past interval */ |
---|
1129 | if (hdr->caplen < offset) |
---|
1130 | return; |
---|
1131 | uhdr->interval = SWAPLONG(uhdr->interval); |
---|
1132 | |
---|
1133 | offset += 4; /* skip past start_frame */ |
---|
1134 | if (hdr->caplen < offset) |
---|
1135 | return; |
---|
1136 | uhdr->start_frame = SWAPLONG(uhdr->start_frame); |
---|
1137 | |
---|
1138 | offset += 4; /* skip past xfer_flags */ |
---|
1139 | if (hdr->caplen < offset) |
---|
1140 | return; |
---|
1141 | uhdr->xfer_flags = SWAPLONG(uhdr->xfer_flags); |
---|
1142 | |
---|
1143 | offset += 4; /* skip past ndesc */ |
---|
1144 | if (hdr->caplen < offset) |
---|
1145 | return; |
---|
1146 | uhdr->ndesc = SWAPLONG(uhdr->ndesc); |
---|
1147 | } |
---|
1148 | |
---|
1149 | if (uhdr->transfer_type == URB_ISOCHRONOUS) { |
---|
1150 | /* swap the values in struct linux_usb_isodesc */ |
---|
1151 | pisodesc = (usb_isodesc *)(void *)(buf+offset); |
---|
1152 | numdesc = uhdr->s.iso.numdesc; |
---|
1153 | for (i = 0; i < numdesc; i++) { |
---|
1154 | offset += 4; /* skip past status */ |
---|
1155 | if (hdr->caplen < offset) |
---|
1156 | return; |
---|
1157 | pisodesc->status = SWAPLONG(pisodesc->status); |
---|
1158 | |
---|
1159 | offset += 4; /* skip past offset */ |
---|
1160 | if (hdr->caplen < offset) |
---|
1161 | return; |
---|
1162 | pisodesc->offset = SWAPLONG(pisodesc->offset); |
---|
1163 | |
---|
1164 | offset += 4; /* skip past len */ |
---|
1165 | if (hdr->caplen < offset) |
---|
1166 | return; |
---|
1167 | pisodesc->len = SWAPLONG(pisodesc->len); |
---|
1168 | |
---|
1169 | offset += 4; /* skip past padding */ |
---|
1170 | |
---|
1171 | pisodesc++; |
---|
1172 | } |
---|
1173 | } |
---|
1174 | } |
---|