1 | /*- |
---|
2 | * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 |
---|
3 | * The Regents of the University of California. All rights reserved. |
---|
4 | * |
---|
5 | * This code is derived from the Stanford/CMU enet packet filter, |
---|
6 | * (net/enet.c) distributed as part of 4.3BSD, and code contributed |
---|
7 | * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence |
---|
8 | * Berkeley Laboratory. |
---|
9 | * |
---|
10 | * Redistribution and use in source and binary forms, with or without |
---|
11 | * modification, are permitted provided that the following conditions |
---|
12 | * are met: |
---|
13 | * 1. Redistributions of source code must retain the above copyright |
---|
14 | * notice, this list of conditions and the following disclaimer. |
---|
15 | * 2. Redistributions in binary form must reproduce the above copyright |
---|
16 | * notice, this list of conditions and the following disclaimer in the |
---|
17 | * documentation and/or other materials provided with the distribution. |
---|
18 | * 3. Neither the name of the University nor the names of its contributors |
---|
19 | * may be used to endorse or promote products derived from this software |
---|
20 | * without specific prior written permission. |
---|
21 | * |
---|
22 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
---|
23 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
---|
24 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
---|
25 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
---|
26 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
---|
27 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
---|
28 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
---|
29 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
---|
30 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
---|
31 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
---|
32 | * SUCH DAMAGE. |
---|
33 | * |
---|
34 | * @(#)bpf.h 7.1 (Berkeley) 5/7/91 |
---|
35 | * |
---|
36 | * $FreeBSD$ |
---|
37 | */ |
---|
38 | |
---|
39 | #ifndef _NET_DLT_H_ |
---|
40 | #define _NET_DLT_H_ |
---|
41 | |
---|
42 | /* |
---|
43 | * Link-layer header type codes. |
---|
44 | * |
---|
45 | * Do *NOT* add new values to this list without asking |
---|
46 | * "tcpdump-workers@lists.tcpdump.org" for a value. Otherwise, you run |
---|
47 | * the risk of using a value that's already being used for some other |
---|
48 | * purpose, and of having tools that read libpcap-format captures not |
---|
49 | * being able to handle captures with your new DLT_ value, with no hope |
---|
50 | * that they will ever be changed to do so (as that would destroy their |
---|
51 | * ability to read captures using that value for that other purpose). |
---|
52 | * |
---|
53 | * See |
---|
54 | * |
---|
55 | * http://www.tcpdump.org/linktypes.html |
---|
56 | * |
---|
57 | * for detailed descriptions of some of these link-layer header types. |
---|
58 | */ |
---|
59 | |
---|
60 | /* |
---|
61 | * These are the types that are the same on all platforms, and that |
---|
62 | * have been defined by <net/bpf.h> for ages. |
---|
63 | */ |
---|
64 | #define DLT_NULL 0 /* BSD loopback encapsulation */ |
---|
65 | #define DLT_EN10MB 1 /* Ethernet (10Mb) */ |
---|
66 | #define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */ |
---|
67 | #define DLT_AX25 3 /* Amateur Radio AX.25 */ |
---|
68 | #define DLT_PRONET 4 /* Proteon ProNET Token Ring */ |
---|
69 | #define DLT_CHAOS 5 /* Chaos */ |
---|
70 | #define DLT_IEEE802 6 /* 802.5 Token Ring */ |
---|
71 | #define DLT_ARCNET 7 /* ARCNET, with BSD-style header */ |
---|
72 | #define DLT_SLIP 8 /* Serial Line IP */ |
---|
73 | #define DLT_PPP 9 /* Point-to-point Protocol */ |
---|
74 | #define DLT_FDDI 10 /* FDDI */ |
---|
75 | |
---|
76 | /* |
---|
77 | * These are types that are different on some platforms, and that |
---|
78 | * have been defined by <net/bpf.h> for ages. We use #ifdefs to |
---|
79 | * detect the BSDs that define them differently from the traditional |
---|
80 | * libpcap <net/bpf.h> |
---|
81 | * |
---|
82 | * XXX - DLT_ATM_RFC1483 is 13 in BSD/OS, and DLT_RAW is 14 in BSD/OS, |
---|
83 | * but I don't know what the right #define is for BSD/OS. |
---|
84 | */ |
---|
85 | #define DLT_ATM_RFC1483 11 /* LLC-encapsulated ATM */ |
---|
86 | |
---|
87 | #ifdef __OpenBSD__ |
---|
88 | #define DLT_RAW 14 /* raw IP */ |
---|
89 | #else |
---|
90 | #define DLT_RAW 12 /* raw IP */ |
---|
91 | #endif |
---|
92 | |
---|
93 | /* |
---|
94 | * Given that the only OS that currently generates BSD/OS SLIP or PPP |
---|
95 | * is, well, BSD/OS, arguably everybody should have chosen its values |
---|
96 | * for DLT_SLIP_BSDOS and DLT_PPP_BSDOS, which are 15 and 16, but they |
---|
97 | * didn't. So it goes. |
---|
98 | */ |
---|
99 | #if defined(__NetBSD__) || defined(__FreeBSD__) |
---|
100 | #ifndef DLT_SLIP_BSDOS |
---|
101 | #define DLT_SLIP_BSDOS 13 /* BSD/OS Serial Line IP */ |
---|
102 | #define DLT_PPP_BSDOS 14 /* BSD/OS Point-to-point Protocol */ |
---|
103 | #endif |
---|
104 | #else |
---|
105 | #define DLT_SLIP_BSDOS 15 /* BSD/OS Serial Line IP */ |
---|
106 | #define DLT_PPP_BSDOS 16 /* BSD/OS Point-to-point Protocol */ |
---|
107 | #endif |
---|
108 | |
---|
109 | /* |
---|
110 | * 17 was used for DLT_PFLOG in OpenBSD; it no longer is. |
---|
111 | * |
---|
112 | * It was DLT_LANE8023 in SuSE 6.3, so we defined LINKTYPE_PFLOG |
---|
113 | * as 117 so that pflog captures would use a link-layer header type |
---|
114 | * value that didn't collide with any other values. On all |
---|
115 | * platforms other than OpenBSD, we defined DLT_PFLOG as 117, |
---|
116 | * and we mapped between LINKTYPE_PFLOG and DLT_PFLOG. |
---|
117 | * |
---|
118 | * OpenBSD eventually switched to using 117 for DLT_PFLOG as well. |
---|
119 | * |
---|
120 | * Don't use 17 for anything else. |
---|
121 | */ |
---|
122 | |
---|
123 | /* |
---|
124 | * 18 is used for DLT_PFSYNC in OpenBSD, NetBSD, DragonFly BSD and |
---|
125 | * Mac OS X; don't use it for anything else. (FreeBSD uses 121, |
---|
126 | * which collides with DLT_HHDLC, even though it doesn't use 18 |
---|
127 | * for anything and doesn't appear to have ever used it for anything.) |
---|
128 | * |
---|
129 | * We define it as 18 on those platforms; it is, unfortunately, used |
---|
130 | * for DLT_CIP in Suse 6.3, so we don't define it as DLT_PFSYNC |
---|
131 | * in general. As the packet format for it, like that for |
---|
132 | * DLT_PFLOG, is not only OS-dependent but OS-version-dependent, |
---|
133 | * we don't support printing it in tcpdump except on OSes that |
---|
134 | * have the relevant header files, so it's not that useful on |
---|
135 | * other platforms. |
---|
136 | */ |
---|
137 | #if defined(__OpenBSD__) || defined(__NetBSD__) || defined(__DragonFly__) || defined(__APPLE__) |
---|
138 | #define DLT_PFSYNC 18 |
---|
139 | #endif |
---|
140 | |
---|
141 | #define DLT_ATM_CLIP 19 /* Linux Classical-IP over ATM */ |
---|
142 | |
---|
143 | /* |
---|
144 | * Apparently Redback uses this for its SmartEdge 400/800. I hope |
---|
145 | * nobody else decided to use it, too. |
---|
146 | */ |
---|
147 | #define DLT_REDBACK_SMARTEDGE 32 |
---|
148 | |
---|
149 | /* |
---|
150 | * These values are defined by NetBSD; other platforms should refrain from |
---|
151 | * using them for other purposes, so that NetBSD savefiles with link |
---|
152 | * types of 50 or 51 can be read as this type on all platforms. |
---|
153 | */ |
---|
154 | #define DLT_PPP_SERIAL 50 /* PPP over serial with HDLC encapsulation */ |
---|
155 | #define DLT_PPP_ETHER 51 /* PPP over Ethernet */ |
---|
156 | |
---|
157 | /* |
---|
158 | * The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses |
---|
159 | * a link-layer type of 99 for the tcpdump it supplies. The link-layer |
---|
160 | * header has 6 bytes of unknown data, something that appears to be an |
---|
161 | * Ethernet type, and 36 bytes that appear to be 0 in at least one capture |
---|
162 | * I've seen. |
---|
163 | */ |
---|
164 | #define DLT_SYMANTEC_FIREWALL 99 |
---|
165 | |
---|
166 | /* |
---|
167 | * Values between 100 and 103 are used in capture file headers as |
---|
168 | * link-layer header type LINKTYPE_ values corresponding to DLT_ types |
---|
169 | * that differ between platforms; don't use those values for new DLT_ |
---|
170 | * new types. |
---|
171 | */ |
---|
172 | |
---|
173 | /* |
---|
174 | * Values starting with 104 are used for newly-assigned link-layer |
---|
175 | * header type values; for those link-layer header types, the DLT_ |
---|
176 | * value returned by pcap_datalink() and passed to pcap_open_dead(), |
---|
177 | * and the LINKTYPE_ value that appears in capture files, are the |
---|
178 | * same. |
---|
179 | * |
---|
180 | * DLT_MATCHING_MIN is the lowest such value; DLT_MATCHING_MAX is |
---|
181 | * the highest such value. |
---|
182 | */ |
---|
183 | #define DLT_MATCHING_MIN 104 |
---|
184 | |
---|
185 | /* |
---|
186 | * This value was defined by libpcap 0.5; platforms that have defined |
---|
187 | * it with a different value should define it here with that value - |
---|
188 | * a link type of 104 in a save file will be mapped to DLT_C_HDLC, |
---|
189 | * whatever value that happens to be, so programs will correctly |
---|
190 | * handle files with that link type regardless of the value of |
---|
191 | * DLT_C_HDLC. |
---|
192 | * |
---|
193 | * The name DLT_C_HDLC was used by BSD/OS; we use that name for source |
---|
194 | * compatibility with programs written for BSD/OS. |
---|
195 | * |
---|
196 | * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well, |
---|
197 | * for source compatibility with programs written for libpcap 0.5. |
---|
198 | */ |
---|
199 | #define DLT_C_HDLC 104 /* Cisco HDLC */ |
---|
200 | #define DLT_CHDLC DLT_C_HDLC |
---|
201 | |
---|
202 | #define DLT_IEEE802_11 105 /* IEEE 802.11 wireless */ |
---|
203 | |
---|
204 | /* |
---|
205 | * 106 is reserved for Linux Classical IP over ATM; it's like DLT_RAW, |
---|
206 | * except when it isn't. (I.e., sometimes it's just raw IP, and |
---|
207 | * sometimes it isn't.) We currently handle it as DLT_LINUX_SLL, |
---|
208 | * so that we don't have to worry about the link-layer header.) |
---|
209 | */ |
---|
210 | |
---|
211 | /* |
---|
212 | * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides |
---|
213 | * with other values. |
---|
214 | * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header |
---|
215 | * (DLCI, etc.). |
---|
216 | */ |
---|
217 | #define DLT_FRELAY 107 |
---|
218 | |
---|
219 | /* |
---|
220 | * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except |
---|
221 | * that the AF_ type in the link-layer header is in network byte order. |
---|
222 | * |
---|
223 | * DLT_LOOP is 12 in OpenBSD, but that's DLT_RAW in other OSes, so |
---|
224 | * we don't use 12 for it in OSes other than OpenBSD. |
---|
225 | */ |
---|
226 | #ifdef __OpenBSD__ |
---|
227 | #define DLT_LOOP 12 |
---|
228 | #else |
---|
229 | #define DLT_LOOP 108 |
---|
230 | #endif |
---|
231 | |
---|
232 | /* |
---|
233 | * Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's |
---|
234 | * DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other |
---|
235 | * than OpenBSD. |
---|
236 | */ |
---|
237 | #ifdef __OpenBSD__ |
---|
238 | #define DLT_ENC 13 |
---|
239 | #else |
---|
240 | #define DLT_ENC 109 |
---|
241 | #endif |
---|
242 | |
---|
243 | /* |
---|
244 | * Values between 110 and 112 are reserved for use in capture file headers |
---|
245 | * as link-layer types corresponding to DLT_ types that might differ |
---|
246 | * between platforms; don't use those values for new DLT_ types |
---|
247 | * other than the corresponding DLT_ types. |
---|
248 | */ |
---|
249 | |
---|
250 | /* |
---|
251 | * This is for Linux cooked sockets. |
---|
252 | */ |
---|
253 | #define DLT_LINUX_SLL 113 |
---|
254 | |
---|
255 | /* |
---|
256 | * Apple LocalTalk hardware. |
---|
257 | */ |
---|
258 | #define DLT_LTALK 114 |
---|
259 | |
---|
260 | /* |
---|
261 | * Acorn Econet. |
---|
262 | */ |
---|
263 | #define DLT_ECONET 115 |
---|
264 | |
---|
265 | /* |
---|
266 | * Reserved for use with OpenBSD ipfilter. |
---|
267 | */ |
---|
268 | #define DLT_IPFILTER 116 |
---|
269 | |
---|
270 | /* |
---|
271 | * OpenBSD DLT_PFLOG. |
---|
272 | */ |
---|
273 | #define DLT_PFLOG 117 |
---|
274 | |
---|
275 | /* |
---|
276 | * Registered for Cisco-internal use. |
---|
277 | */ |
---|
278 | #define DLT_CISCO_IOS 118 |
---|
279 | |
---|
280 | /* |
---|
281 | * For 802.11 cards using the Prism II chips, with a link-layer |
---|
282 | * header including Prism monitor mode information plus an 802.11 |
---|
283 | * header. |
---|
284 | */ |
---|
285 | #define DLT_PRISM_HEADER 119 |
---|
286 | |
---|
287 | /* |
---|
288 | * Reserved for Aironet 802.11 cards, with an Aironet link-layer header |
---|
289 | * (see Doug Ambrisko's FreeBSD patches). |
---|
290 | */ |
---|
291 | #define DLT_AIRONET_HEADER 120 |
---|
292 | |
---|
293 | /* |
---|
294 | * Sigh. |
---|
295 | * |
---|
296 | * 121 was reserved for Siemens HiPath HDLC on 2002-01-25, as |
---|
297 | * requested by Tomas Kukosa. |
---|
298 | * |
---|
299 | * On 2004-02-25, a FreeBSD checkin to sys/net/bpf.h was made that |
---|
300 | * assigned 121 as DLT_PFSYNC. In current versions, its libpcap |
---|
301 | * does DLT_ <-> LINKTYPE_ mapping, mapping DLT_PFSYNC to a |
---|
302 | * LINKTYPE_PFSYNC value of 246, so it should write out DLT_PFSYNC |
---|
303 | * dump files with 246 as the link-layer header type. (Earlier |
---|
304 | * versions might not have done mapping, in which case they would |
---|
305 | * have written them out with a link-layer header type of 121.) |
---|
306 | * |
---|
307 | * OpenBSD, from which pf came, however, uses 18 for DLT_PFSYNC; |
---|
308 | * its libpcap does no DLT_ <-> LINKTYPE_ mapping, so it would |
---|
309 | * write out DLT_PFSYNC dump files with use 18 as the link-layer |
---|
310 | * header type. |
---|
311 | * |
---|
312 | * NetBSD, DragonFly BSD, and Darwin also use 18 for DLT_PFSYNC; in |
---|
313 | * current versions, their libpcaps do DLT_ <-> LINKTYPE_ mapping, |
---|
314 | * mapping DLT_PFSYNC to a LINKTYPE_PFSYNC value of 246, so they |
---|
315 | * should write out DLT_PFSYNC dump files with 246 as the link-layer |
---|
316 | * header type. (Earlier versions might not have done mapping, |
---|
317 | * in which case they'd work the same way OpenBSD does, writing |
---|
318 | * them out with a link-layer header type of 18.) |
---|
319 | * |
---|
320 | * We'll define DLT_PFSYNC as: |
---|
321 | * |
---|
322 | * 18 on NetBSD, OpenBSD, DragonFly BSD, and Darwin; |
---|
323 | * |
---|
324 | * 121 on FreeBSD; |
---|
325 | * |
---|
326 | * 246 everywhere else. |
---|
327 | * |
---|
328 | * We'll define DLT_HHDLC as 121 on everything except for FreeBSD; |
---|
329 | * anybody who wants to compile, on FreeBSD, code that uses DLT_HHDLC |
---|
330 | * is out of luck. |
---|
331 | * |
---|
332 | * We'll define LINKTYPE_PFSYNC as 246 on *all* platforms, so that |
---|
333 | * savefiles written using *this* code won't use 18 or 121 for PFSYNC, |
---|
334 | * they'll all use 246. |
---|
335 | * |
---|
336 | * Code that uses pcap_datalink() to determine the link-layer header |
---|
337 | * type of a savefile won't, when built and run on FreeBSD, be able |
---|
338 | * to distinguish between LINKTYPE_PFSYNC and LINKTYPE_HHDLC capture |
---|
339 | * files, as pcap_datalink() will give 121 for both of them. Code |
---|
340 | * that doesn't, such as the code in Wireshark, will be able to |
---|
341 | * distinguish between them. |
---|
342 | * |
---|
343 | * FreeBSD's libpcap won't map a link-layer header type of 18 - i.e., |
---|
344 | * DLT_PFSYNC files from OpenBSD and possibly older versions of NetBSD, |
---|
345 | * DragonFly BSD, and OS X - to DLT_PFSYNC, so code built with FreeBSD's |
---|
346 | * libpcap won't treat those files as DLT_PFSYNC files. |
---|
347 | * |
---|
348 | * Other libpcaps won't map a link-layer header type of 121 to DLT_PFSYNC; |
---|
349 | * this means they can read DLT_HHDLC files, if any exist, but won't |
---|
350 | * treat pcap files written by any older versions of FreeBSD libpcap that |
---|
351 | * didn't map to 246 as DLT_PFSYNC files. |
---|
352 | */ |
---|
353 | #ifdef __FreeBSD__ |
---|
354 | #define DLT_PFSYNC 121 |
---|
355 | #else |
---|
356 | #define DLT_HHDLC 121 |
---|
357 | #endif |
---|
358 | |
---|
359 | /* |
---|
360 | * This is for RFC 2625 IP-over-Fibre Channel. |
---|
361 | * |
---|
362 | * This is not for use with raw Fibre Channel, where the link-layer |
---|
363 | * header starts with a Fibre Channel frame header; it's for IP-over-FC, |
---|
364 | * where the link-layer header starts with an RFC 2625 Network_Header |
---|
365 | * field. |
---|
366 | */ |
---|
367 | #define DLT_IP_OVER_FC 122 |
---|
368 | |
---|
369 | /* |
---|
370 | * This is for Full Frontal ATM on Solaris with SunATM, with a |
---|
371 | * pseudo-header followed by an AALn PDU. |
---|
372 | * |
---|
373 | * There may be other forms of Full Frontal ATM on other OSes, |
---|
374 | * with different pseudo-headers. |
---|
375 | * |
---|
376 | * If ATM software returns a pseudo-header with VPI/VCI information |
---|
377 | * (and, ideally, packet type information, e.g. signalling, ILMI, |
---|
378 | * LANE, LLC-multiplexed traffic, etc.), it should not use |
---|
379 | * DLT_ATM_RFC1483, but should get a new DLT_ value, so tcpdump |
---|
380 | * and the like don't have to infer the presence or absence of a |
---|
381 | * pseudo-header and the form of the pseudo-header. |
---|
382 | */ |
---|
383 | #define DLT_SUNATM 123 /* Solaris+SunATM */ |
---|
384 | |
---|
385 | /* |
---|
386 | * Reserved as per request from Kent Dahlgren <kent@praesum.com> |
---|
387 | * for private use. |
---|
388 | */ |
---|
389 | #define DLT_RIO 124 /* RapidIO */ |
---|
390 | #define DLT_PCI_EXP 125 /* PCI Express */ |
---|
391 | #define DLT_AURORA 126 /* Xilinx Aurora link layer */ |
---|
392 | |
---|
393 | /* |
---|
394 | * Header for 802.11 plus a number of bits of link-layer information |
---|
395 | * including radio information, used by some recent BSD drivers as |
---|
396 | * well as the madwifi Atheros driver for Linux. |
---|
397 | */ |
---|
398 | #define DLT_IEEE802_11_RADIO 127 /* 802.11 plus radiotap radio header */ |
---|
399 | |
---|
400 | /* |
---|
401 | * Reserved for the TZSP encapsulation, as per request from |
---|
402 | * Chris Waters <chris.waters@networkchemistry.com> |
---|
403 | * TZSP is a generic encapsulation for any other link type, |
---|
404 | * which includes a means to include meta-information |
---|
405 | * with the packet, e.g. signal strength and channel |
---|
406 | * for 802.11 packets. |
---|
407 | */ |
---|
408 | #define DLT_TZSP 128 /* Tazmen Sniffer Protocol */ |
---|
409 | |
---|
410 | /* |
---|
411 | * BSD's ARCNET headers have the source host, destination host, |
---|
412 | * and type at the beginning of the packet; that's what's handed |
---|
413 | * up to userland via BPF. |
---|
414 | * |
---|
415 | * Linux's ARCNET headers, however, have a 2-byte offset field |
---|
416 | * between the host IDs and the type; that's what's handed up |
---|
417 | * to userland via PF_PACKET sockets. |
---|
418 | * |
---|
419 | * We therefore have to have separate DLT_ values for them. |
---|
420 | */ |
---|
421 | #define DLT_ARCNET_LINUX 129 /* ARCNET */ |
---|
422 | |
---|
423 | /* |
---|
424 | * Juniper-private data link types, as per request from |
---|
425 | * Hannes Gredler <hannes@juniper.net>. The DLT_s are used |
---|
426 | * for passing on chassis-internal metainformation such as |
---|
427 | * QOS profiles, etc.. |
---|
428 | */ |
---|
429 | #define DLT_JUNIPER_MLPPP 130 |
---|
430 | #define DLT_JUNIPER_MLFR 131 |
---|
431 | #define DLT_JUNIPER_ES 132 |
---|
432 | #define DLT_JUNIPER_GGSN 133 |
---|
433 | #define DLT_JUNIPER_MFR 134 |
---|
434 | #define DLT_JUNIPER_ATM2 135 |
---|
435 | #define DLT_JUNIPER_SERVICES 136 |
---|
436 | #define DLT_JUNIPER_ATM1 137 |
---|
437 | |
---|
438 | /* |
---|
439 | * Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund |
---|
440 | * <dieter@apple.com>. The header that's presented is an Ethernet-like |
---|
441 | * header: |
---|
442 | * |
---|
443 | * #define FIREWIRE_EUI64_LEN 8 |
---|
444 | * struct firewire_header { |
---|
445 | * u_char firewire_dhost[FIREWIRE_EUI64_LEN]; |
---|
446 | * u_char firewire_shost[FIREWIRE_EUI64_LEN]; |
---|
447 | * u_short firewire_type; |
---|
448 | * }; |
---|
449 | * |
---|
450 | * with "firewire_type" being an Ethernet type value, rather than, |
---|
451 | * for example, raw GASP frames being handed up. |
---|
452 | */ |
---|
453 | #define DLT_APPLE_IP_OVER_IEEE1394 138 |
---|
454 | |
---|
455 | /* |
---|
456 | * Various SS7 encapsulations, as per a request from Jeff Morriss |
---|
457 | * <jeff.morriss[AT]ulticom.com> and subsequent discussions. |
---|
458 | */ |
---|
459 | #define DLT_MTP2_WITH_PHDR 139 /* pseudo-header with various info, followed by MTP2 */ |
---|
460 | #define DLT_MTP2 140 /* MTP2, without pseudo-header */ |
---|
461 | #define DLT_MTP3 141 /* MTP3, without pseudo-header or MTP2 */ |
---|
462 | #define DLT_SCCP 142 /* SCCP, without pseudo-header or MTP2 or MTP3 */ |
---|
463 | |
---|
464 | /* |
---|
465 | * DOCSIS MAC frames. |
---|
466 | */ |
---|
467 | #define DLT_DOCSIS 143 |
---|
468 | |
---|
469 | /* |
---|
470 | * Linux-IrDA packets. Protocol defined at http://www.irda.org. |
---|
471 | * Those packets include IrLAP headers and above (IrLMP...), but |
---|
472 | * don't include Phy framing (SOF/EOF/CRC & byte stuffing), because Phy |
---|
473 | * framing can be handled by the hardware and depend on the bitrate. |
---|
474 | * This is exactly the format you would get capturing on a Linux-IrDA |
---|
475 | * interface (irdaX), but not on a raw serial port. |
---|
476 | * Note the capture is done in "Linux-cooked" mode, so each packet include |
---|
477 | * a fake packet header (struct sll_header). This is because IrDA packet |
---|
478 | * decoding is dependant on the direction of the packet (incomming or |
---|
479 | * outgoing). |
---|
480 | * When/if other platform implement IrDA capture, we may revisit the |
---|
481 | * issue and define a real DLT_IRDA... |
---|
482 | * Jean II |
---|
483 | */ |
---|
484 | #define DLT_LINUX_IRDA 144 |
---|
485 | |
---|
486 | /* |
---|
487 | * Reserved for IBM SP switch and IBM Next Federation switch. |
---|
488 | */ |
---|
489 | #define DLT_IBM_SP 145 |
---|
490 | #define DLT_IBM_SN 146 |
---|
491 | |
---|
492 | /* |
---|
493 | * Reserved for private use. If you have some link-layer header type |
---|
494 | * that you want to use within your organization, with the capture files |
---|
495 | * using that link-layer header type not ever be sent outside your |
---|
496 | * organization, you can use these values. |
---|
497 | * |
---|
498 | * No libpcap release will use these for any purpose, nor will any |
---|
499 | * tcpdump release use them, either. |
---|
500 | * |
---|
501 | * Do *NOT* use these in capture files that you expect anybody not using |
---|
502 | * your private versions of capture-file-reading tools to read; in |
---|
503 | * particular, do *NOT* use them in products, otherwise you may find that |
---|
504 | * people won't be able to use tcpdump, or snort, or Ethereal, or... to |
---|
505 | * read capture files from your firewall/intrusion detection/traffic |
---|
506 | * monitoring/etc. appliance, or whatever product uses that DLT_ value, |
---|
507 | * and you may also find that the developers of those applications will |
---|
508 | * not accept patches to let them read those files. |
---|
509 | * |
---|
510 | * Also, do not use them if somebody might send you a capture using them |
---|
511 | * for *their* private type and tools using them for *your* private type |
---|
512 | * would have to read them. |
---|
513 | * |
---|
514 | * Instead, ask "tcpdump-workers@lists.tcpdump.org" for a new DLT_ value, |
---|
515 | * as per the comment above, and use the type you're given. |
---|
516 | */ |
---|
517 | #define DLT_USER0 147 |
---|
518 | #define DLT_USER1 148 |
---|
519 | #define DLT_USER2 149 |
---|
520 | #define DLT_USER3 150 |
---|
521 | #define DLT_USER4 151 |
---|
522 | #define DLT_USER5 152 |
---|
523 | #define DLT_USER6 153 |
---|
524 | #define DLT_USER7 154 |
---|
525 | #define DLT_USER8 155 |
---|
526 | #define DLT_USER9 156 |
---|
527 | #define DLT_USER10 157 |
---|
528 | #define DLT_USER11 158 |
---|
529 | #define DLT_USER12 159 |
---|
530 | #define DLT_USER13 160 |
---|
531 | #define DLT_USER14 161 |
---|
532 | #define DLT_USER15 162 |
---|
533 | |
---|
534 | /* |
---|
535 | * For future use with 802.11 captures - defined by AbsoluteValue |
---|
536 | * Systems to store a number of bits of link-layer information |
---|
537 | * including radio information: |
---|
538 | * |
---|
539 | * http://www.shaftnet.org/~pizza/software/capturefrm.txt |
---|
540 | * |
---|
541 | * but it might be used by some non-AVS drivers now or in the |
---|
542 | * future. |
---|
543 | */ |
---|
544 | #define DLT_IEEE802_11_RADIO_AVS 163 /* 802.11 plus AVS radio header */ |
---|
545 | |
---|
546 | /* |
---|
547 | * Juniper-private data link type, as per request from |
---|
548 | * Hannes Gredler <hannes@juniper.net>. The DLT_s are used |
---|
549 | * for passing on chassis-internal metainformation such as |
---|
550 | * QOS profiles, etc.. |
---|
551 | */ |
---|
552 | #define DLT_JUNIPER_MONITOR 164 |
---|
553 | |
---|
554 | /* |
---|
555 | * BACnet MS/TP frames. |
---|
556 | */ |
---|
557 | #define DLT_BACNET_MS_TP 165 |
---|
558 | |
---|
559 | /* |
---|
560 | * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>. |
---|
561 | * |
---|
562 | * This is used in some OSes to allow a kernel socket filter to distinguish |
---|
563 | * between incoming and outgoing packets, on a socket intended to |
---|
564 | * supply pppd with outgoing packets so it can do dial-on-demand and |
---|
565 | * hangup-on-lack-of-demand; incoming packets are filtered out so they |
---|
566 | * don't cause pppd to hold the connection up (you don't want random |
---|
567 | * input packets such as port scans, packets from old lost connections, |
---|
568 | * etc. to force the connection to stay up). |
---|
569 | * |
---|
570 | * The first byte of the PPP header (0xff03) is modified to accomodate |
---|
571 | * the direction - 0x00 = IN, 0x01 = OUT. |
---|
572 | */ |
---|
573 | #define DLT_PPP_PPPD 166 |
---|
574 | |
---|
575 | /* |
---|
576 | * Names for backwards compatibility with older versions of some PPP |
---|
577 | * software; new software should use DLT_PPP_PPPD. |
---|
578 | */ |
---|
579 | #define DLT_PPP_WITH_DIRECTION DLT_PPP_PPPD |
---|
580 | #define DLT_LINUX_PPP_WITHDIRECTION DLT_PPP_PPPD |
---|
581 | |
---|
582 | /* |
---|
583 | * Juniper-private data link type, as per request from |
---|
584 | * Hannes Gredler <hannes@juniper.net>. The DLT_s are used |
---|
585 | * for passing on chassis-internal metainformation such as |
---|
586 | * QOS profiles, cookies, etc.. |
---|
587 | */ |
---|
588 | #define DLT_JUNIPER_PPPOE 167 |
---|
589 | #define DLT_JUNIPER_PPPOE_ATM 168 |
---|
590 | |
---|
591 | #define DLT_GPRS_LLC 169 /* GPRS LLC */ |
---|
592 | #define DLT_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */ |
---|
593 | #define DLT_GPF_F 171 /* GPF-F (ITU-T G.7041/Y.1303) */ |
---|
594 | |
---|
595 | /* |
---|
596 | * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line |
---|
597 | * monitoring equipment. |
---|
598 | */ |
---|
599 | #define DLT_GCOM_T1E1 172 |
---|
600 | #define DLT_GCOM_SERIAL 173 |
---|
601 | |
---|
602 | /* |
---|
603 | * Juniper-private data link type, as per request from |
---|
604 | * Hannes Gredler <hannes@juniper.net>. The DLT_ is used |
---|
605 | * for internal communication to Physical Interface Cards (PIC) |
---|
606 | */ |
---|
607 | #define DLT_JUNIPER_PIC_PEER 174 |
---|
608 | |
---|
609 | /* |
---|
610 | * Link types requested by Gregor Maier <gregor@endace.com> of Endace |
---|
611 | * Measurement Systems. They add an ERF header (see |
---|
612 | * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of |
---|
613 | * the link-layer header. |
---|
614 | */ |
---|
615 | #define DLT_ERF_ETH 175 /* Ethernet */ |
---|
616 | #define DLT_ERF_POS 176 /* Packet-over-SONET */ |
---|
617 | |
---|
618 | /* |
---|
619 | * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD |
---|
620 | * for vISDN (http://www.orlandi.com/visdn/). Its link-layer header |
---|
621 | * includes additional information before the LAPD header, so it's |
---|
622 | * not necessarily a generic LAPD header. |
---|
623 | */ |
---|
624 | #define DLT_LINUX_LAPD 177 |
---|
625 | |
---|
626 | /* |
---|
627 | * Juniper-private data link type, as per request from |
---|
628 | * Hannes Gredler <hannes@juniper.net>. |
---|
629 | * The DLT_ are used for prepending meta-information |
---|
630 | * like interface index, interface name |
---|
631 | * before standard Ethernet, PPP, Frelay & C-HDLC Frames |
---|
632 | */ |
---|
633 | #define DLT_JUNIPER_ETHER 178 |
---|
634 | #define DLT_JUNIPER_PPP 179 |
---|
635 | #define DLT_JUNIPER_FRELAY 180 |
---|
636 | #define DLT_JUNIPER_CHDLC 181 |
---|
637 | |
---|
638 | /* |
---|
639 | * Multi Link Frame Relay (FRF.16) |
---|
640 | */ |
---|
641 | #define DLT_MFR 182 |
---|
642 | |
---|
643 | /* |
---|
644 | * Juniper-private data link type, as per request from |
---|
645 | * Hannes Gredler <hannes@juniper.net>. |
---|
646 | * The DLT_ is used for internal communication with a |
---|
647 | * voice Adapter Card (PIC) |
---|
648 | */ |
---|
649 | #define DLT_JUNIPER_VP 183 |
---|
650 | |
---|
651 | /* |
---|
652 | * Arinc 429 frames. |
---|
653 | * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. |
---|
654 | * Every frame contains a 32bit A429 label. |
---|
655 | * More documentation on Arinc 429 can be found at |
---|
656 | * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf |
---|
657 | */ |
---|
658 | #define DLT_A429 184 |
---|
659 | |
---|
660 | /* |
---|
661 | * Arinc 653 Interpartition Communication messages. |
---|
662 | * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. |
---|
663 | * Please refer to the A653-1 standard for more information. |
---|
664 | */ |
---|
665 | #define DLT_A653_ICM 185 |
---|
666 | |
---|
667 | /* |
---|
668 | * This used to be "USB packets, beginning with a USB setup header; |
---|
669 | * requested by Paolo Abeni <paolo.abeni@email.it>." |
---|
670 | * |
---|
671 | * However, that header didn't work all that well - it left out some |
---|
672 | * useful information - and was abandoned in favor of the DLT_USB_LINUX |
---|
673 | * header. |
---|
674 | * |
---|
675 | * This is now used by FreeBSD for its BPF taps for USB; that has its |
---|
676 | * own headers. So it is written, so it is done. |
---|
677 | * |
---|
678 | * For source-code compatibility, we also define DLT_USB to have this |
---|
679 | * value. We do it numerically so that, if code that includes this |
---|
680 | * file (directly or indirectly) also includes an OS header that also |
---|
681 | * defines DLT_USB as 186, we don't get a redefinition warning. |
---|
682 | * (NetBSD 7 does that.) |
---|
683 | */ |
---|
684 | #define DLT_USB_FREEBSD 186 |
---|
685 | #define DLT_USB 186 |
---|
686 | |
---|
687 | /* |
---|
688 | * Bluetooth HCI UART transport layer (part H:4); requested by |
---|
689 | * Paolo Abeni. |
---|
690 | */ |
---|
691 | #define DLT_BLUETOOTH_HCI_H4 187 |
---|
692 | |
---|
693 | /* |
---|
694 | * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz |
---|
695 | * <cruz_petagay@bah.com>. |
---|
696 | */ |
---|
697 | #define DLT_IEEE802_16_MAC_CPS 188 |
---|
698 | |
---|
699 | /* |
---|
700 | * USB packets, beginning with a Linux USB header; requested by |
---|
701 | * Paolo Abeni <paolo.abeni@email.it>. |
---|
702 | */ |
---|
703 | #define DLT_USB_LINUX 189 |
---|
704 | |
---|
705 | /* |
---|
706 | * Controller Area Network (CAN) v. 2.0B packets. |
---|
707 | * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. |
---|
708 | * Used to dump CAN packets coming from a CAN Vector board. |
---|
709 | * More documentation on the CAN v2.0B frames can be found at |
---|
710 | * http://www.can-cia.org/downloads/?269 |
---|
711 | */ |
---|
712 | #define DLT_CAN20B 190 |
---|
713 | |
---|
714 | /* |
---|
715 | * IEEE 802.15.4, with address fields padded, as is done by Linux |
---|
716 | * drivers; requested by Juergen Schimmer. |
---|
717 | */ |
---|
718 | #define DLT_IEEE802_15_4_LINUX 191 |
---|
719 | |
---|
720 | /* |
---|
721 | * Per Packet Information encapsulated packets. |
---|
722 | * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. |
---|
723 | */ |
---|
724 | #define DLT_PPI 192 |
---|
725 | |
---|
726 | /* |
---|
727 | * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header; |
---|
728 | * requested by Charles Clancy. |
---|
729 | */ |
---|
730 | #define DLT_IEEE802_16_MAC_CPS_RADIO 193 |
---|
731 | |
---|
732 | /* |
---|
733 | * Juniper-private data link type, as per request from |
---|
734 | * Hannes Gredler <hannes@juniper.net>. |
---|
735 | * The DLT_ is used for internal communication with a |
---|
736 | * integrated service module (ISM). |
---|
737 | */ |
---|
738 | #define DLT_JUNIPER_ISM 194 |
---|
739 | |
---|
740 | /* |
---|
741 | * IEEE 802.15.4, exactly as it appears in the spec (no padding, no |
---|
742 | * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>. |
---|
743 | * For this one, we expect the FCS to be present at the end of the frame; |
---|
744 | * if the frame has no FCS, DLT_IEEE802_15_4_NOFCS should be used. |
---|
745 | */ |
---|
746 | #define DLT_IEEE802_15_4 195 |
---|
747 | |
---|
748 | /* |
---|
749 | * Various link-layer types, with a pseudo-header, for SITA |
---|
750 | * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com). |
---|
751 | */ |
---|
752 | #define DLT_SITA 196 |
---|
753 | |
---|
754 | /* |
---|
755 | * Various link-layer types, with a pseudo-header, for Endace DAG cards; |
---|
756 | * encapsulates Endace ERF records. Requested by Stephen Donnelly |
---|
757 | * <stephen@endace.com>. |
---|
758 | */ |
---|
759 | #define DLT_ERF 197 |
---|
760 | |
---|
761 | /* |
---|
762 | * Special header prepended to Ethernet packets when capturing from a |
---|
763 | * u10 Networks board. Requested by Phil Mulholland |
---|
764 | * <phil@u10networks.com>. |
---|
765 | */ |
---|
766 | #define DLT_RAIF1 198 |
---|
767 | |
---|
768 | /* |
---|
769 | * IPMB packet for IPMI, beginning with the I2C slave address, followed |
---|
770 | * by the netFn and LUN, etc.. Requested by Chanthy Toeung |
---|
771 | * <chanthy.toeung@ca.kontron.com>. |
---|
772 | */ |
---|
773 | #define DLT_IPMB 199 |
---|
774 | |
---|
775 | /* |
---|
776 | * Juniper-private data link type, as per request from |
---|
777 | * Hannes Gredler <hannes@juniper.net>. |
---|
778 | * The DLT_ is used for capturing data on a secure tunnel interface. |
---|
779 | */ |
---|
780 | #define DLT_JUNIPER_ST 200 |
---|
781 | |
---|
782 | /* |
---|
783 | * Bluetooth HCI UART transport layer (part H:4), with pseudo-header |
---|
784 | * that includes direction information; requested by Paolo Abeni. |
---|
785 | */ |
---|
786 | #define DLT_BLUETOOTH_HCI_H4_WITH_PHDR 201 |
---|
787 | |
---|
788 | /* |
---|
789 | * AX.25 packet with a 1-byte KISS header; see |
---|
790 | * |
---|
791 | * http://www.ax25.net/kiss.htm |
---|
792 | * |
---|
793 | * as per Richard Stearn <richard@rns-stearn.demon.co.uk>. |
---|
794 | */ |
---|
795 | #define DLT_AX25_KISS 202 |
---|
796 | |
---|
797 | /* |
---|
798 | * LAPD packets from an ISDN channel, starting with the address field, |
---|
799 | * with no pseudo-header. |
---|
800 | * Requested by Varuna De Silva <varunax@gmail.com>. |
---|
801 | */ |
---|
802 | #define DLT_LAPD 203 |
---|
803 | |
---|
804 | /* |
---|
805 | * Variants of various link-layer headers, with a one-byte direction |
---|
806 | * pseudo-header prepended - zero means "received by this host", |
---|
807 | * non-zero (any non-zero value) means "sent by this host" - as per |
---|
808 | * Will Barker <w.barker@zen.co.uk>. |
---|
809 | */ |
---|
810 | #define DLT_PPP_WITH_DIR 204 /* PPP - don't confuse with DLT_PPP_WITH_DIRECTION */ |
---|
811 | #define DLT_C_HDLC_WITH_DIR 205 /* Cisco HDLC */ |
---|
812 | #define DLT_FRELAY_WITH_DIR 206 /* Frame Relay */ |
---|
813 | #define DLT_LAPB_WITH_DIR 207 /* LAPB */ |
---|
814 | |
---|
815 | /* |
---|
816 | * 208 is reserved for an as-yet-unspecified proprietary link-layer |
---|
817 | * type, as requested by Will Barker. |
---|
818 | */ |
---|
819 | |
---|
820 | /* |
---|
821 | * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman |
---|
822 | * <avn@pigeonpoint.com>. |
---|
823 | */ |
---|
824 | #define DLT_IPMB_LINUX 209 |
---|
825 | |
---|
826 | /* |
---|
827 | * FlexRay automotive bus - http://www.flexray.com/ - as requested |
---|
828 | * by Hannes Kaelber <hannes.kaelber@x2e.de>. |
---|
829 | */ |
---|
830 | #define DLT_FLEXRAY 210 |
---|
831 | |
---|
832 | /* |
---|
833 | * Media Oriented Systems Transport (MOST) bus for multimedia |
---|
834 | * transport - http://www.mostcooperation.com/ - as requested |
---|
835 | * by Hannes Kaelber <hannes.kaelber@x2e.de>. |
---|
836 | */ |
---|
837 | #define DLT_MOST 211 |
---|
838 | |
---|
839 | /* |
---|
840 | * Local Interconnect Network (LIN) bus for vehicle networks - |
---|
841 | * http://www.lin-subbus.org/ - as requested by Hannes Kaelber |
---|
842 | * <hannes.kaelber@x2e.de>. |
---|
843 | */ |
---|
844 | #define DLT_LIN 212 |
---|
845 | |
---|
846 | /* |
---|
847 | * X2E-private data link type used for serial line capture, |
---|
848 | * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>. |
---|
849 | */ |
---|
850 | #define DLT_X2E_SERIAL 213 |
---|
851 | |
---|
852 | /* |
---|
853 | * X2E-private data link type used for the Xoraya data logger |
---|
854 | * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>. |
---|
855 | */ |
---|
856 | #define DLT_X2E_XORAYA 214 |
---|
857 | |
---|
858 | /* |
---|
859 | * IEEE 802.15.4, exactly as it appears in the spec (no padding, no |
---|
860 | * nothing), but with the PHY-level data for non-ASK PHYs (4 octets |
---|
861 | * of 0 as preamble, one octet of SFD, one octet of frame length+ |
---|
862 | * reserved bit, and then the MAC-layer data, starting with the |
---|
863 | * frame control field). |
---|
864 | * |
---|
865 | * Requested by Max Filippov <jcmvbkbc@gmail.com>. |
---|
866 | */ |
---|
867 | #define DLT_IEEE802_15_4_NONASK_PHY 215 |
---|
868 | |
---|
869 | /* |
---|
870 | * David Gibson <david@gibson.dropbear.id.au> requested this for |
---|
871 | * captures from the Linux kernel /dev/input/eventN devices. This |
---|
872 | * is used to communicate keystrokes and mouse movements from the |
---|
873 | * Linux kernel to display systems, such as Xorg. |
---|
874 | */ |
---|
875 | #define DLT_LINUX_EVDEV 216 |
---|
876 | |
---|
877 | /* |
---|
878 | * GSM Um and Abis interfaces, preceded by a "gsmtap" header. |
---|
879 | * |
---|
880 | * Requested by Harald Welte <laforge@gnumonks.org>. |
---|
881 | */ |
---|
882 | #define DLT_GSMTAP_UM 217 |
---|
883 | #define DLT_GSMTAP_ABIS 218 |
---|
884 | |
---|
885 | /* |
---|
886 | * MPLS, with an MPLS label as the link-layer header. |
---|
887 | * Requested by Michele Marchetto <michele@openbsd.org> on behalf |
---|
888 | * of OpenBSD. |
---|
889 | */ |
---|
890 | #define DLT_MPLS 219 |
---|
891 | |
---|
892 | /* |
---|
893 | * USB packets, beginning with a Linux USB header, with the USB header |
---|
894 | * padded to 64 bytes; required for memory-mapped access. |
---|
895 | */ |
---|
896 | #define DLT_USB_LINUX_MMAPPED 220 |
---|
897 | |
---|
898 | /* |
---|
899 | * DECT packets, with a pseudo-header; requested by |
---|
900 | * Matthias Wenzel <tcpdump@mazzoo.de>. |
---|
901 | */ |
---|
902 | #define DLT_DECT 221 |
---|
903 | |
---|
904 | /* |
---|
905 | * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov> |
---|
906 | * Date: Mon, 11 May 2009 11:18:30 -0500 |
---|
907 | * |
---|
908 | * DLT_AOS. We need it for AOS Space Data Link Protocol. |
---|
909 | * I have already written dissectors for but need an OK from |
---|
910 | * legal before I can submit a patch. |
---|
911 | * |
---|
912 | */ |
---|
913 | #define DLT_AOS 222 |
---|
914 | |
---|
915 | /* |
---|
916 | * Wireless HART (Highway Addressable Remote Transducer) |
---|
917 | * From the HART Communication Foundation |
---|
918 | * IES/PAS 62591 |
---|
919 | * |
---|
920 | * Requested by Sam Roberts <vieuxtech@gmail.com>. |
---|
921 | */ |
---|
922 | #define DLT_WIHART 223 |
---|
923 | |
---|
924 | /* |
---|
925 | * Fibre Channel FC-2 frames, beginning with a Frame_Header. |
---|
926 | * Requested by Kahou Lei <kahou82@gmail.com>. |
---|
927 | */ |
---|
928 | #define DLT_FC_2 224 |
---|
929 | |
---|
930 | /* |
---|
931 | * Fibre Channel FC-2 frames, beginning with an encoding of the |
---|
932 | * SOF, and ending with an encoding of the EOF. |
---|
933 | * |
---|
934 | * The encodings represent the frame delimiters as 4-byte sequences |
---|
935 | * representing the corresponding ordered sets, with K28.5 |
---|
936 | * represented as 0xBC, and the D symbols as the corresponding |
---|
937 | * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2, |
---|
938 | * is represented as 0xBC 0xB5 0x55 0x55. |
---|
939 | * |
---|
940 | * Requested by Kahou Lei <kahou82@gmail.com>. |
---|
941 | */ |
---|
942 | #define DLT_FC_2_WITH_FRAME_DELIMS 225 |
---|
943 | |
---|
944 | /* |
---|
945 | * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>. |
---|
946 | * |
---|
947 | * The pseudo-header starts with a one-byte version number; for version 2, |
---|
948 | * the pseudo-header is: |
---|
949 | * |
---|
950 | * struct dl_ipnetinfo { |
---|
951 | * u_int8_t dli_version; |
---|
952 | * u_int8_t dli_family; |
---|
953 | * u_int16_t dli_htype; |
---|
954 | * u_int32_t dli_pktlen; |
---|
955 | * u_int32_t dli_ifindex; |
---|
956 | * u_int32_t dli_grifindex; |
---|
957 | * u_int32_t dli_zsrc; |
---|
958 | * u_int32_t dli_zdst; |
---|
959 | * }; |
---|
960 | * |
---|
961 | * dli_version is 2 for the current version of the pseudo-header. |
---|
962 | * |
---|
963 | * dli_family is a Solaris address family value, so it's 2 for IPv4 |
---|
964 | * and 26 for IPv6. |
---|
965 | * |
---|
966 | * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing |
---|
967 | * packets, and 2 for packets arriving from another zone on the same |
---|
968 | * machine. |
---|
969 | * |
---|
970 | * dli_pktlen is the length of the packet data following the pseudo-header |
---|
971 | * (so the captured length minus dli_pktlen is the length of the |
---|
972 | * pseudo-header, assuming the entire pseudo-header was captured). |
---|
973 | * |
---|
974 | * dli_ifindex is the interface index of the interface on which the |
---|
975 | * packet arrived. |
---|
976 | * |
---|
977 | * dli_grifindex is the group interface index number (for IPMP interfaces). |
---|
978 | * |
---|
979 | * dli_zsrc is the zone identifier for the source of the packet. |
---|
980 | * |
---|
981 | * dli_zdst is the zone identifier for the destination of the packet. |
---|
982 | * |
---|
983 | * A zone number of 0 is the global zone; a zone number of 0xffffffff |
---|
984 | * means that the packet arrived from another host on the network, not |
---|
985 | * from another zone on the same machine. |
---|
986 | * |
---|
987 | * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates |
---|
988 | * which of those it is. |
---|
989 | */ |
---|
990 | #define DLT_IPNET 226 |
---|
991 | |
---|
992 | /* |
---|
993 | * CAN (Controller Area Network) frames, with a pseudo-header as supplied |
---|
994 | * by Linux SocketCAN, and with multi-byte numerical fields in that header |
---|
995 | * in big-endian byte order. |
---|
996 | * |
---|
997 | * See Documentation/networking/can.txt in the Linux source. |
---|
998 | * |
---|
999 | * Requested by Felix Obenhuber <felix@obenhuber.de>. |
---|
1000 | */ |
---|
1001 | #define DLT_CAN_SOCKETCAN 227 |
---|
1002 | |
---|
1003 | /* |
---|
1004 | * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies |
---|
1005 | * whether it's v4 or v6. Requested by Darren Reed <Darren.Reed@Sun.COM>. |
---|
1006 | */ |
---|
1007 | #define DLT_IPV4 228 |
---|
1008 | #define DLT_IPV6 229 |
---|
1009 | |
---|
1010 | /* |
---|
1011 | * IEEE 802.15.4, exactly as it appears in the spec (no padding, no |
---|
1012 | * nothing), and with no FCS at the end of the frame; requested by |
---|
1013 | * Jon Smirl <jonsmirl@gmail.com>. |
---|
1014 | */ |
---|
1015 | #define DLT_IEEE802_15_4_NOFCS 230 |
---|
1016 | |
---|
1017 | /* |
---|
1018 | * Raw D-Bus: |
---|
1019 | * |
---|
1020 | * http://www.freedesktop.org/wiki/Software/dbus |
---|
1021 | * |
---|
1022 | * messages: |
---|
1023 | * |
---|
1024 | * http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages |
---|
1025 | * |
---|
1026 | * starting with the endianness flag, followed by the message type, etc., |
---|
1027 | * but without the authentication handshake before the message sequence: |
---|
1028 | * |
---|
1029 | * http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol |
---|
1030 | * |
---|
1031 | * Requested by Martin Vidner <martin@vidner.net>. |
---|
1032 | */ |
---|
1033 | #define DLT_DBUS 231 |
---|
1034 | |
---|
1035 | /* |
---|
1036 | * Juniper-private data link type, as per request from |
---|
1037 | * Hannes Gredler <hannes@juniper.net>. |
---|
1038 | */ |
---|
1039 | #define DLT_JUNIPER_VS 232 |
---|
1040 | #define DLT_JUNIPER_SRX_E2E 233 |
---|
1041 | #define DLT_JUNIPER_FIBRECHANNEL 234 |
---|
1042 | |
---|
1043 | /* |
---|
1044 | * DVB-CI (DVB Common Interface for communication between a PC Card |
---|
1045 | * module and a DVB receiver). See |
---|
1046 | * |
---|
1047 | * http://www.kaiser.cx/pcap-dvbci.html |
---|
1048 | * |
---|
1049 | * for the specification. |
---|
1050 | * |
---|
1051 | * Requested by Martin Kaiser <martin@kaiser.cx>. |
---|
1052 | */ |
---|
1053 | #define DLT_DVB_CI 235 |
---|
1054 | |
---|
1055 | /* |
---|
1056 | * Variant of 3GPP TS 27.010 multiplexing protocol (similar to, but |
---|
1057 | * *not* the same as, 27.010). Requested by Hans-Christoph Schemmel |
---|
1058 | * <hans-christoph.schemmel@cinterion.com>. |
---|
1059 | */ |
---|
1060 | #define DLT_MUX27010 236 |
---|
1061 | |
---|
1062 | /* |
---|
1063 | * STANAG 5066 D_PDUs. Requested by M. Baris Demiray |
---|
1064 | * <barisdemiray@gmail.com>. |
---|
1065 | */ |
---|
1066 | #define DLT_STANAG_5066_D_PDU 237 |
---|
1067 | |
---|
1068 | /* |
---|
1069 | * Juniper-private data link type, as per request from |
---|
1070 | * Hannes Gredler <hannes@juniper.net>. |
---|
1071 | */ |
---|
1072 | #define DLT_JUNIPER_ATM_CEMIC 238 |
---|
1073 | |
---|
1074 | /* |
---|
1075 | * NetFilter LOG messages |
---|
1076 | * (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets) |
---|
1077 | * |
---|
1078 | * Requested by Jakub Zawadzki <darkjames-ws@darkjames.pl> |
---|
1079 | */ |
---|
1080 | #define DLT_NFLOG 239 |
---|
1081 | |
---|
1082 | /* |
---|
1083 | * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type |
---|
1084 | * for Ethernet packets with a 4-byte pseudo-header and always |
---|
1085 | * with the payload including the FCS, as supplied by their |
---|
1086 | * netANALYZER hardware and software. |
---|
1087 | * |
---|
1088 | * Requested by Holger P. Frommer <HPfrommer@hilscher.com> |
---|
1089 | */ |
---|
1090 | #define DLT_NETANALYZER 240 |
---|
1091 | |
---|
1092 | /* |
---|
1093 | * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type |
---|
1094 | * for Ethernet packets with a 4-byte pseudo-header and FCS and |
---|
1095 | * with the Ethernet header preceded by 7 bytes of preamble and |
---|
1096 | * 1 byte of SFD, as supplied by their netANALYZER hardware and |
---|
1097 | * software. |
---|
1098 | * |
---|
1099 | * Requested by Holger P. Frommer <HPfrommer@hilscher.com> |
---|
1100 | */ |
---|
1101 | #define DLT_NETANALYZER_TRANSPARENT 241 |
---|
1102 | |
---|
1103 | /* |
---|
1104 | * IP-over-InfiniBand, as specified by RFC 4391. |
---|
1105 | * |
---|
1106 | * Requested by Petr Sumbera <petr.sumbera@oracle.com>. |
---|
1107 | */ |
---|
1108 | #define DLT_IPOIB 242 |
---|
1109 | |
---|
1110 | /* |
---|
1111 | * MPEG-2 transport stream (ISO 13818-1/ITU-T H.222.0). |
---|
1112 | * |
---|
1113 | * Requested by Guy Martin <gmsoft@tuxicoman.be>. |
---|
1114 | */ |
---|
1115 | #define DLT_MPEG_2_TS 243 |
---|
1116 | |
---|
1117 | /* |
---|
1118 | * ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as |
---|
1119 | * used by their ng40 protocol tester. |
---|
1120 | * |
---|
1121 | * Requested by Jens Grimmer <jens.grimmer@ng4t.com>. |
---|
1122 | */ |
---|
1123 | #define DLT_NG40 244 |
---|
1124 | |
---|
1125 | /* |
---|
1126 | * Pseudo-header giving adapter number and flags, followed by an NFC |
---|
1127 | * (Near-Field Communications) Logical Link Control Protocol (LLCP) PDU, |
---|
1128 | * as specified by NFC Forum Logical Link Control Protocol Technical |
---|
1129 | * Specification LLCP 1.1. |
---|
1130 | * |
---|
1131 | * Requested by Mike Wakerly <mikey@google.com>. |
---|
1132 | */ |
---|
1133 | #define DLT_NFC_LLCP 245 |
---|
1134 | |
---|
1135 | /* |
---|
1136 | * 246 is used as LINKTYPE_PFSYNC; do not use it for any other purpose. |
---|
1137 | * |
---|
1138 | * DLT_PFSYNC has different values on different platforms, and all of |
---|
1139 | * them collide with something used elsewhere. On platforms that |
---|
1140 | * don't already define it, define it as 246. |
---|
1141 | */ |
---|
1142 | #if !defined(__FreeBSD__) && !defined(__OpenBSD__) && !defined(__NetBSD__) && !defined(__DragonFly__) && !defined(__APPLE__) |
---|
1143 | #define DLT_PFSYNC 246 |
---|
1144 | #endif |
---|
1145 | |
---|
1146 | /* |
---|
1147 | * Raw InfiniBand packets, starting with the Local Routing Header. |
---|
1148 | * |
---|
1149 | * Requested by Oren Kladnitsky <orenk@mellanox.com>. |
---|
1150 | */ |
---|
1151 | #define DLT_INFINIBAND 247 |
---|
1152 | |
---|
1153 | /* |
---|
1154 | * SCTP, with no lower-level protocols (i.e., no IPv4 or IPv6). |
---|
1155 | * |
---|
1156 | * Requested by Michael Tuexen <Michael.Tuexen@lurchi.franken.de>. |
---|
1157 | */ |
---|
1158 | #define DLT_SCTP 248 |
---|
1159 | |
---|
1160 | /* |
---|
1161 | * USB packets, beginning with a USBPcap header. |
---|
1162 | * |
---|
1163 | * Requested by Tomasz Mon <desowin@gmail.com> |
---|
1164 | */ |
---|
1165 | #define DLT_USBPCAP 249 |
---|
1166 | |
---|
1167 | /* |
---|
1168 | * Schweitzer Engineering Laboratories "RTAC" product serial-line |
---|
1169 | * packets. |
---|
1170 | * |
---|
1171 | * Requested by Chris Bontje <chris_bontje@selinc.com>. |
---|
1172 | */ |
---|
1173 | #define DLT_RTAC_SERIAL 250 |
---|
1174 | |
---|
1175 | /* |
---|
1176 | * Bluetooth Low Energy air interface link-layer packets. |
---|
1177 | * |
---|
1178 | * Requested by Mike Kershaw <dragorn@kismetwireless.net>. |
---|
1179 | */ |
---|
1180 | #define DLT_BLUETOOTH_LE_LL 251 |
---|
1181 | |
---|
1182 | /* |
---|
1183 | * DLT type for upper-protocol layer PDU saves from wireshark. |
---|
1184 | * |
---|
1185 | * the actual contents are determined by two TAGs stored with each |
---|
1186 | * packet: |
---|
1187 | * EXP_PDU_TAG_LINKTYPE the link type (LINKTYPE_ value) of the |
---|
1188 | * original packet. |
---|
1189 | * |
---|
1190 | * EXP_PDU_TAG_PROTO_NAME the name of the wireshark dissector |
---|
1191 | * that can make sense of the data stored. |
---|
1192 | */ |
---|
1193 | #define DLT_WIRESHARK_UPPER_PDU 252 |
---|
1194 | |
---|
1195 | /* |
---|
1196 | * DLT type for the netlink protocol (nlmon devices). |
---|
1197 | */ |
---|
1198 | #define DLT_NETLINK 253 |
---|
1199 | |
---|
1200 | /* |
---|
1201 | * Bluetooth Linux Monitor headers for the BlueZ stack. |
---|
1202 | */ |
---|
1203 | #define DLT_BLUETOOTH_LINUX_MONITOR 254 |
---|
1204 | |
---|
1205 | /* |
---|
1206 | * Bluetooth Basic Rate/Enhanced Data Rate baseband packets, as |
---|
1207 | * captured by Ubertooth. |
---|
1208 | */ |
---|
1209 | #define DLT_BLUETOOTH_BREDR_BB 255 |
---|
1210 | |
---|
1211 | /* |
---|
1212 | * Bluetooth Low Energy link layer packets, as captured by Ubertooth. |
---|
1213 | */ |
---|
1214 | #define DLT_BLUETOOTH_LE_LL_WITH_PHDR 256 |
---|
1215 | |
---|
1216 | /* |
---|
1217 | * PROFIBUS data link layer. |
---|
1218 | */ |
---|
1219 | #define DLT_PROFIBUS_DL 257 |
---|
1220 | |
---|
1221 | /* |
---|
1222 | * Apple's DLT_PKTAP headers. |
---|
1223 | * |
---|
1224 | * Sadly, the folks at Apple either had no clue that the DLT_USERn values |
---|
1225 | * are for internal use within an organization and partners only, and |
---|
1226 | * didn't know that the right way to get a link-layer header type is to |
---|
1227 | * ask tcpdump.org for one, or knew and didn't care, so they just |
---|
1228 | * used DLT_USER2, which causes problems for everything except for |
---|
1229 | * their version of tcpdump. |
---|
1230 | * |
---|
1231 | * So I'll just give them one; hopefully this will show up in a |
---|
1232 | * libpcap release in time for them to get this into 10.10 Big Sur |
---|
1233 | * or whatever Mavericks' successor is called. LINKTYPE_PKTAP |
---|
1234 | * will be 258 *even on OS X*; that is *intentional*, so that |
---|
1235 | * PKTAP files look the same on *all* OSes (different OSes can have |
---|
1236 | * different numerical values for a given DLT_, but *MUST NOT* have |
---|
1237 | * different values for what goes in a file, as files can be moved |
---|
1238 | * between OSes!). |
---|
1239 | * |
---|
1240 | * When capturing, on a system with a Darwin-based OS, on a device |
---|
1241 | * that returns 149 (DLT_USER2 and Apple's DLT_PKTAP) with this |
---|
1242 | * version of libpcap, the DLT_ value for the pcap_t will be DLT_PKTAP, |
---|
1243 | * and that will continue to be DLT_USER2 on Darwin-based OSes. That way, |
---|
1244 | * binary compatibility with Mavericks is preserved for programs using |
---|
1245 | * this version of libpcap. This does mean that if you were using |
---|
1246 | * DLT_USER2 for some capture device on OS X, you can't do so with |
---|
1247 | * this version of libpcap, just as you can't with Apple's libpcap - |
---|
1248 | * on OS X, they define DLT_PKTAP to be DLT_USER2, so programs won't |
---|
1249 | * be able to distinguish between PKTAP and whatever you were using |
---|
1250 | * DLT_USER2 for. |
---|
1251 | * |
---|
1252 | * If the program saves the capture to a file using this version of |
---|
1253 | * libpcap's pcap_dump code, the LINKTYPE_ value in the file will be |
---|
1254 | * LINKTYPE_PKTAP, which will be 258, even on Darwin-based OSes. |
---|
1255 | * That way, the file will *not* be a DLT_USER2 file. That means |
---|
1256 | * that the latest version of tcpdump, when built with this version |
---|
1257 | * of libpcap, and sufficiently recent versions of Wireshark will |
---|
1258 | * be able to read those files and interpret them correctly; however, |
---|
1259 | * Apple's version of tcpdump in OS X 10.9 won't be able to handle |
---|
1260 | * them. (Hopefully, Apple will pick up this version of libpcap, |
---|
1261 | * and the corresponding version of tcpdump, so that tcpdump will |
---|
1262 | * be able to handle the old LINKTYPE_USER2 captures *and* the new |
---|
1263 | * LINKTYPE_PKTAP captures.) |
---|
1264 | */ |
---|
1265 | #ifdef __APPLE__ |
---|
1266 | #define DLT_PKTAP DLT_USER2 |
---|
1267 | #else |
---|
1268 | #define DLT_PKTAP 258 |
---|
1269 | #endif |
---|
1270 | |
---|
1271 | /* |
---|
1272 | * Ethernet packets preceded by a header giving the last 6 octets |
---|
1273 | * of the preamble specified by 802.3-2012 Clause 65, section |
---|
1274 | * 65.1.3.2 "Transmit". |
---|
1275 | */ |
---|
1276 | #define DLT_EPON 259 |
---|
1277 | |
---|
1278 | /* |
---|
1279 | * IPMI trace packets, as specified by Table 3-20 "Trace Data Block Format" |
---|
1280 | * in the PICMG HPM.2 specification. |
---|
1281 | */ |
---|
1282 | #define DLT_IPMI_HPM_2 260 |
---|
1283 | |
---|
1284 | /* |
---|
1285 | * per Joshua Wright <jwright@hasborg.com>, formats for Zwave captures. |
---|
1286 | */ |
---|
1287 | #define DLT_ZWAVE_R1_R2 261 |
---|
1288 | #define DLT_ZWAVE_R3 262 |
---|
1289 | |
---|
1290 | /* |
---|
1291 | * per Steve Karg <skarg@users.sourceforge.net>, formats for Wattstopper |
---|
1292 | * Digital Lighting Management room bus serial protocol captures. |
---|
1293 | */ |
---|
1294 | #define DLT_WATTSTOPPER_DLM 263 |
---|
1295 | |
---|
1296 | /* |
---|
1297 | * ISO 14443 contactless smart card messages. |
---|
1298 | */ |
---|
1299 | #define DLT_ISO_14443 264 |
---|
1300 | |
---|
1301 | /* |
---|
1302 | * Radio data system (RDS) groups. IEC 62106. |
---|
1303 | * Per Jonathan Brucker <jonathan.brucke@gmail.com>. |
---|
1304 | */ |
---|
1305 | #define DLT_RDS 265 |
---|
1306 | |
---|
1307 | /* |
---|
1308 | * In case the code that includes this file (directly or indirectly) |
---|
1309 | * has also included OS files that happen to define DLT_MATCHING_MAX, |
---|
1310 | * with a different value (perhaps because that OS hasn't picked up |
---|
1311 | * the latest version of our DLT definitions), we undefine the |
---|
1312 | * previous value of DLT_MATCHING_MAX. |
---|
1313 | */ |
---|
1314 | #ifdef DLT_MATCHING_MAX |
---|
1315 | #undef DLT_MATCHING_MAX |
---|
1316 | #endif |
---|
1317 | #define DLT_MATCHING_MAX 265 /* highest value in the "matching" range */ |
---|
1318 | |
---|
1319 | /* |
---|
1320 | * DLT and savefile link type values are split into a class and |
---|
1321 | * a member of that class. A class value of 0 indicates a regular |
---|
1322 | * DLT_/LINKTYPE_ value. |
---|
1323 | */ |
---|
1324 | #define DLT_CLASS(x) ((x) & 0x03ff0000) |
---|
1325 | |
---|
1326 | /* |
---|
1327 | * NetBSD-specific generic "raw" link type. The class value indicates |
---|
1328 | * that this is the generic raw type, and the lower 16 bits are the |
---|
1329 | * address family we're dealing with. Those values are NetBSD-specific; |
---|
1330 | * do not assume that they correspond to AF_ values for your operating |
---|
1331 | * system. |
---|
1332 | */ |
---|
1333 | #define DLT_CLASS_NETBSD_RAWAF 0x02240000 |
---|
1334 | #define DLT_NETBSD_RAWAF(af) (DLT_CLASS_NETBSD_RAWAF | (af)) |
---|
1335 | #define DLT_NETBSD_RAWAF_AF(x) ((x) & 0x0000ffff) |
---|
1336 | #define DLT_IS_NETBSD_RAWAF(x) (DLT_CLASS(x) == DLT_CLASS_NETBSD_RAWAF) |
---|
1337 | |
---|
1338 | #endif /* !_NET_DLT_H_ */ |
---|