JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 1993, 1994, 1995, 1996, 1997 |
| 3 | * The Regents of the University of California. All rights reserved. |
| 4 | * |
| 5 | * Redistribution and use in source and binary forms, with or without |
| 6 | * modification, are permitted provided that: (1) source code distributions |
| 7 | * retain the above copyright notice and this paragraph in its entirety, (2) |
| 8 | * distributions including binary code include the above copyright notice and |
| 9 | * this paragraph in its entirety in the documentation or other materials |
| 10 | * provided with the distribution, and (3) all advertising materials mentioning |
| 11 | * features or use of this software display the following acknowledgement: |
| 12 | * ``This product includes software developed by the University of California, |
| 13 | * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of |
| 14 | * the University nor the names of its contributors may be used to endorse |
| 15 | * or promote products derived from this software without specific prior |
| 16 | * written permission. |
| 17 | * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED |
| 18 | * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF |
| 19 | * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. |
| 20 | * |
| 21 | * pcap-common.c - common code for pcap and pcap-ng files |
| 22 | */ |
| 23 | |
| 24 | #ifdef HAVE_CONFIG_H |
| 25 | #include "config.h" |
| 26 | #endif |
| 27 | |
| 28 | #ifdef WIN32 |
| 29 | #include <pcap-stdinc.h> |
| 30 | #else /* WIN32 */ |
| 31 | #if HAVE_INTTYPES_H |
| 32 | #include <inttypes.h> |
| 33 | #elif HAVE_STDINT_H |
| 34 | #include <stdint.h> |
| 35 | #endif |
| 36 | #ifdef HAVE_SYS_BITYPES_H |
| 37 | #include <sys/bitypes.h> |
| 38 | #endif |
| 39 | #include <sys/types.h> |
| 40 | #endif /* WIN32 */ |
| 41 | |
| 42 | #include "pcap-int.h" |
| 43 | #include "pcap/usb.h" |
| 44 | #include "pcap/nflog.h" |
| 45 | |
| 46 | #include "pcap-common.h" |
| 47 | |
| 48 | /* |
| 49 | * We don't write DLT_* values to capture files, because they're not the |
| 50 | * same on all platforms. |
| 51 | * |
| 52 | * Unfortunately, the various flavors of BSD have not always used the same |
| 53 | * numerical values for the same data types, and various patches to |
| 54 | * libpcap for non-BSD OSes have added their own DLT_* codes for link |
| 55 | * layer encapsulation types seen on those OSes, and those codes have had, |
| 56 | * in some cases, values that were also used, on other platforms, for other |
| 57 | * link layer encapsulation types. |
| 58 | * |
| 59 | * This means that capture files of a type whose numerical DLT_* code |
| 60 | * means different things on different BSDs, or with different versions |
| 61 | * of libpcap, can't always be read on systems other than those like |
| 62 | * the one running on the machine on which the capture was made. |
| 63 | * |
| 64 | * Instead, we define here a set of LINKTYPE_* codes, and map DLT_* codes |
| 65 | * to LINKTYPE_* codes when writing a savefile header, and map LINKTYPE_* |
| 66 | * codes to DLT_* codes when reading a savefile header. |
| 67 | * |
| 68 | * For those DLT_* codes that have, as far as we know, the same values on |
| 69 | * all platforms (DLT_NULL through DLT_FDDI), we define LINKTYPE_xxx as |
| 70 | * DLT_xxx; that way, captures of those types can still be read by |
| 71 | * versions of libpcap that map LINKTYPE_* values to DLT_* values, and |
| 72 | * captures of those types written by versions of libpcap that map DLT_ |
| 73 | * values to LINKTYPE_ values can still be read by older versions |
| 74 | * of libpcap. |
| 75 | * |
| 76 | * The other LINKTYPE_* codes are given values starting at 100, in the |
| 77 | * hopes that no DLT_* code will be given one of those values. |
| 78 | * |
| 79 | * In order to ensure that a given LINKTYPE_* code's value will refer to |
| 80 | * the same encapsulation type on all platforms, you should not allocate |
| 81 | * a new LINKTYPE_* value without consulting |
| 82 | * "tcpdump-workers@lists.tcpdump.org". The tcpdump developers will |
| 83 | * allocate a value for you, and will not subsequently allocate it to |
| 84 | * anybody else; that value will be added to the "pcap.h" in the |
| 85 | * tcpdump.org Git repository, so that a future libpcap release will |
| 86 | * include it. |
| 87 | * |
| 88 | * You should, if possible, also contribute patches to libpcap and tcpdump |
| 89 | * to handle the new encapsulation type, so that they can also be checked |
| 90 | * into the tcpdump.org Git repository and so that they will appear in |
| 91 | * future libpcap and tcpdump releases. |
| 92 | * |
| 93 | * Do *NOT* assume that any values after the largest value in this file |
| 94 | * are available; you might not have the most up-to-date version of this |
| 95 | * file, and new values after that one might have been assigned. Also, |
| 96 | * do *NOT* use any values below 100 - those might already have been |
| 97 | * taken by one (or more!) organizations. |
| 98 | * |
| 99 | * Any platform that defines additional DLT_* codes should: |
| 100 | * |
| 101 | * request a LINKTYPE_* code and value from tcpdump.org, |
| 102 | * as per the above; |
| 103 | * |
| 104 | * add, in their version of libpcap, an entry to map |
| 105 | * those DLT_* codes to the corresponding LINKTYPE_* |
| 106 | * code; |
| 107 | * |
| 108 | * redefine, in their "net/bpf.h", any DLT_* values |
| 109 | * that collide with the values used by their additional |
| 110 | * DLT_* codes, to remove those collisions (but without |
| 111 | * making them collide with any of the LINKTYPE_* |
| 112 | * values equal to 50 or above; they should also avoid |
| 113 | * defining DLT_* values that collide with those |
| 114 | * LINKTYPE_* values, either). |
| 115 | */ |
| 116 | #define LINKTYPE_NULL DLT_NULL |
| 117 | #define LINKTYPE_ETHERNET DLT_EN10MB /* also for 100Mb and up */ |
| 118 | #define LINKTYPE_EXP_ETHERNET DLT_EN3MB /* 3Mb experimental Ethernet */ |
| 119 | #define LINKTYPE_AX25 DLT_AX25 |
| 120 | #define LINKTYPE_PRONET DLT_PRONET |
| 121 | #define LINKTYPE_CHAOS DLT_CHAOS |
| 122 | #define LINKTYPE_IEEE802_5 DLT_IEEE802 /* DLT_IEEE802 is used for 802.5 Token Ring */ |
| 123 | #define LINKTYPE_ARCNET_BSD DLT_ARCNET /* BSD-style headers */ |
| 124 | #define LINKTYPE_SLIP DLT_SLIP |
| 125 | #define LINKTYPE_PPP DLT_PPP |
| 126 | #define LINKTYPE_FDDI DLT_FDDI |
| 127 | |
| 128 | /* |
| 129 | * LINKTYPE_PPP is for use when there might, or might not, be an RFC 1662 |
| 130 | * PPP in HDLC-like framing header (with 0xff 0x03 before the PPP protocol |
| 131 | * field) at the beginning of the packet. |
| 132 | * |
| 133 | * This is for use when there is always such a header; the address field |
| 134 | * might be 0xff, for regular PPP, or it might be an address field for Cisco |
| 135 | * point-to-point with HDLC framing as per section 4.3.1 of RFC 1547 ("Cisco |
| 136 | * HDLC"). This is, for example, what you get with NetBSD's DLT_PPP_SERIAL. |
| 137 | * |
| 138 | * We give it the same value as NetBSD's DLT_PPP_SERIAL, in the hopes that |
| 139 | * nobody else will choose a DLT_ value of 50, and so that DLT_PPP_SERIAL |
| 140 | * captures will be written out with a link type that NetBSD's tcpdump |
| 141 | * can read. |
| 142 | */ |
| 143 | #define LINKTYPE_PPP_HDLC 50 /* PPP in HDLC-like framing */ |
| 144 | |
| 145 | #define LINKTYPE_PPP_ETHER 51 /* NetBSD PPP-over-Ethernet */ |
| 146 | |
| 147 | #define LINKTYPE_SYMANTEC_FIREWALL 99 /* Symantec Enterprise Firewall */ |
| 148 | |
| 149 | /* |
| 150 | * These correspond to DLT_s that have different values on different |
| 151 | * platforms; we map between these values in capture files and |
| 152 | * the DLT_ values as returned by pcap_datalink() and passed to |
| 153 | * pcap_open_dead(). |
| 154 | */ |
| 155 | #define LINKTYPE_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */ |
| 156 | #define LINKTYPE_RAW 101 /* raw IP */ |
| 157 | #define LINKTYPE_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */ |
| 158 | #define LINKTYPE_PPP_BSDOS 103 /* BSD/OS PPP BPF header */ |
| 159 | |
| 160 | /* |
| 161 | * Values starting with 104 are used for newly-assigned link-layer |
| 162 | * header type values; for those link-layer header types, the DLT_ |
| 163 | * value returned by pcap_datalink() and passed to pcap_open_dead(), |
| 164 | * and the LINKTYPE_ value that appears in capture files, are the |
| 165 | * same. |
| 166 | * |
| 167 | * LINKTYPE_MATCHING_MIN is the lowest such value; LINKTYPE_MATCHING_MAX |
| 168 | * is the highest such value. |
| 169 | */ |
| 170 | #define LINKTYPE_MATCHING_MIN 104 /* lowest value in the "matching" range */ |
| 171 | |
| 172 | #define LINKTYPE_C_HDLC 104 /* Cisco HDLC */ |
| 173 | #define LINKTYPE_IEEE802_11 105 /* IEEE 802.11 (wireless) */ |
| 174 | #define LINKTYPE_ATM_CLIP 106 /* Linux Classical IP over ATM */ |
| 175 | #define LINKTYPE_FRELAY 107 /* Frame Relay */ |
| 176 | #define LINKTYPE_LOOP 108 /* OpenBSD loopback */ |
| 177 | #define LINKTYPE_ENC 109 /* OpenBSD IPSEC enc */ |
| 178 | |
| 179 | /* |
| 180 | * These three types are reserved for future use. |
| 181 | */ |
| 182 | #define LINKTYPE_LANE8023 110 /* ATM LANE + 802.3 */ |
| 183 | #define LINKTYPE_HIPPI 111 /* NetBSD HIPPI */ |
| 184 | #define LINKTYPE_HDLC 112 /* NetBSD HDLC framing */ |
| 185 | |
| 186 | #define LINKTYPE_LINUX_SLL 113 /* Linux cooked socket capture */ |
| 187 | #define LINKTYPE_LTALK 114 /* Apple LocalTalk hardware */ |
| 188 | #define LINKTYPE_ECONET 115 /* Acorn Econet */ |
| 189 | |
| 190 | /* |
| 191 | * Reserved for use with OpenBSD ipfilter. |
| 192 | */ |
| 193 | #define LINKTYPE_IPFILTER 116 |
| 194 | |
| 195 | #define LINKTYPE_PFLOG 117 /* OpenBSD DLT_PFLOG */ |
| 196 | #define LINKTYPE_CISCO_IOS 118 /* For Cisco-internal use */ |
| 197 | #define LINKTYPE_IEEE802_11_PRISM 119 /* 802.11 plus Prism II monitor mode radio metadata header */ |
| 198 | #define LINKTYPE_IEEE802_11_AIRONET 120 /* 802.11 plus FreeBSD Aironet driver radio metadata header */ |
| 199 | |
| 200 | /* |
| 201 | * Reserved for Siemens HiPath HDLC. |
| 202 | */ |
| 203 | #define LINKTYPE_HHDLC 121 |
| 204 | |
| 205 | #define LINKTYPE_IP_OVER_FC 122 /* RFC 2625 IP-over-Fibre Channel */ |
| 206 | #define LINKTYPE_SUNATM 123 /* Solaris+SunATM */ |
| 207 | |
| 208 | /* |
| 209 | * Reserved as per request from Kent Dahlgren <kent@praesum.com> |
| 210 | * for private use. |
| 211 | */ |
| 212 | #define LINKTYPE_RIO 124 /* RapidIO */ |
| 213 | #define LINKTYPE_PCI_EXP 125 /* PCI Express */ |
| 214 | #define LINKTYPE_AURORA 126 /* Xilinx Aurora link layer */ |
| 215 | |
| 216 | #define LINKTYPE_IEEE802_11_RADIOTAP 127 /* 802.11 plus radiotap radio metadata header */ |
| 217 | |
| 218 | /* |
| 219 | * Reserved for the TZSP encapsulation, as per request from |
| 220 | * Chris Waters <chris.waters@networkchemistry.com> |
| 221 | * TZSP is a generic encapsulation for any other link type, |
| 222 | * which includes a means to include meta-information |
| 223 | * with the packet, e.g. signal strength and channel |
| 224 | * for 802.11 packets. |
| 225 | */ |
| 226 | #define LINKTYPE_TZSP 128 /* Tazmen Sniffer Protocol */ |
| 227 | |
| 228 | #define LINKTYPE_ARCNET_LINUX 129 /* Linux-style headers */ |
| 229 | |
| 230 | /* |
| 231 | * Juniper-private data link types, as per request from |
| 232 | * Hannes Gredler <hannes@juniper.net>. The corresponding |
| 233 | * DLT_s are used for passing on chassis-internal |
| 234 | * metainformation such as QOS profiles, etc.. |
| 235 | */ |
| 236 | #define LINKTYPE_JUNIPER_MLPPP 130 |
| 237 | #define LINKTYPE_JUNIPER_MLFR 131 |
| 238 | #define LINKTYPE_JUNIPER_ES 132 |
| 239 | #define LINKTYPE_JUNIPER_GGSN 133 |
| 240 | #define LINKTYPE_JUNIPER_MFR 134 |
| 241 | #define LINKTYPE_JUNIPER_ATM2 135 |
| 242 | #define LINKTYPE_JUNIPER_SERVICES 136 |
| 243 | #define LINKTYPE_JUNIPER_ATM1 137 |
| 244 | |
| 245 | #define LINKTYPE_APPLE_IP_OVER_IEEE1394 138 /* Apple IP-over-IEEE 1394 cooked header */ |
| 246 | |
| 247 | #define LINKTYPE_MTP2_WITH_PHDR 139 |
| 248 | #define LINKTYPE_MTP2 140 |
| 249 | #define LINKTYPE_MTP3 141 |
| 250 | #define LINKTYPE_SCCP 142 |
| 251 | |
| 252 | #define LINKTYPE_DOCSIS 143 /* DOCSIS MAC frames */ |
| 253 | |
| 254 | #define LINKTYPE_LINUX_IRDA 144 /* Linux-IrDA */ |
| 255 | |
| 256 | /* |
| 257 | * Reserved for IBM SP switch and IBM Next Federation switch. |
| 258 | */ |
| 259 | #define LINKTYPE_IBM_SP 145 |
| 260 | #define LINKTYPE_IBM_SN 146 |
| 261 | |
| 262 | /* |
| 263 | * Reserved for private use. If you have some link-layer header type |
| 264 | * that you want to use within your organization, with the capture files |
| 265 | * using that link-layer header type not ever be sent outside your |
| 266 | * organization, you can use these values. |
| 267 | * |
| 268 | * No libpcap release will use these for any purpose, nor will any |
| 269 | * tcpdump release use them, either. |
| 270 | * |
| 271 | * Do *NOT* use these in capture files that you expect anybody not using |
| 272 | * your private versions of capture-file-reading tools to read; in |
| 273 | * particular, do *NOT* use them in products, otherwise you may find that |
| 274 | * people won't be able to use tcpdump, or snort, or Ethereal, or... to |
| 275 | * read capture files from your firewall/intrusion detection/traffic |
| 276 | * monitoring/etc. appliance, or whatever product uses that LINKTYPE_ value, |
| 277 | * and you may also find that the developers of those applications will |
| 278 | * not accept patches to let them read those files. |
| 279 | * |
| 280 | * Also, do not use them if somebody might send you a capture using them |
| 281 | * for *their* private type and tools using them for *your* private type |
| 282 | * would have to read them. |
| 283 | * |
| 284 | * Instead, in those cases, ask "tcpdump-workers@lists.tcpdump.org" for a |
| 285 | * new DLT_ and LINKTYPE_ value, as per the comment in pcap/bpf.h, and use |
| 286 | * the type you're given. |
| 287 | */ |
| 288 | #define LINKTYPE_USER0 147 |
| 289 | #define LINKTYPE_USER1 148 |
| 290 | #define LINKTYPE_USER2 149 |
| 291 | #define LINKTYPE_USER3 150 |
| 292 | #define LINKTYPE_USER4 151 |
| 293 | #define LINKTYPE_USER5 152 |
| 294 | #define LINKTYPE_USER6 153 |
| 295 | #define LINKTYPE_USER7 154 |
| 296 | #define LINKTYPE_USER8 155 |
| 297 | #define LINKTYPE_USER9 156 |
| 298 | #define LINKTYPE_USER10 157 |
| 299 | #define LINKTYPE_USER11 158 |
| 300 | #define LINKTYPE_USER12 159 |
| 301 | #define LINKTYPE_USER13 160 |
| 302 | #define LINKTYPE_USER14 161 |
| 303 | #define LINKTYPE_USER15 162 |
| 304 | |
| 305 | /* |
| 306 | * For future use with 802.11 captures - defined by AbsoluteValue |
| 307 | * Systems to store a number of bits of link-layer information |
| 308 | * including radio information: |
| 309 | * |
| 310 | * http://www.shaftnet.org/~pizza/software/capturefrm.txt |
| 311 | */ |
| 312 | #define LINKTYPE_IEEE802_11_AVS 163 /* 802.11 plus AVS radio metadata header */ |
| 313 | |
| 314 | /* |
| 315 | * Juniper-private data link type, as per request from |
| 316 | * Hannes Gredler <hannes@juniper.net>. The corresponding |
| 317 | * DLT_s are used for passing on chassis-internal |
| 318 | * metainformation such as QOS profiles, etc.. |
| 319 | */ |
| 320 | #define LINKTYPE_JUNIPER_MONITOR 164 |
| 321 | |
| 322 | /* |
| 323 | * BACnet MS/TP frames. |
| 324 | */ |
| 325 | #define LINKTYPE_BACNET_MS_TP 165 |
| 326 | |
| 327 | /* |
| 328 | * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>. |
| 329 | * |
| 330 | * This is used in some OSes to allow a kernel socket filter to distinguish |
| 331 | * between incoming and outgoing packets, on a socket intended to |
| 332 | * supply pppd with outgoing packets so it can do dial-on-demand and |
| 333 | * hangup-on-lack-of-demand; incoming packets are filtered out so they |
| 334 | * don't cause pppd to hold the connection up (you don't want random |
| 335 | * input packets such as port scans, packets from old lost connections, |
| 336 | * etc. to force the connection to stay up). |
| 337 | * |
| 338 | * The first byte of the PPP header (0xff03) is modified to accomodate |
| 339 | * the direction - 0x00 = IN, 0x01 = OUT. |
| 340 | */ |
| 341 | #define LINKTYPE_PPP_PPPD 166 |
| 342 | |
| 343 | /* |
| 344 | * Juniper-private data link type, as per request from |
| 345 | * Hannes Gredler <hannes@juniper.net>. The DLT_s are used |
| 346 | * for passing on chassis-internal metainformation such as |
| 347 | * QOS profiles, cookies, etc.. |
| 348 | */ |
| 349 | #define LINKTYPE_JUNIPER_PPPOE 167 |
| 350 | #define LINKTYPE_JUNIPER_PPPOE_ATM 168 |
| 351 | |
| 352 | #define LINKTYPE_GPRS_LLC 169 /* GPRS LLC */ |
| 353 | #define LINKTYPE_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */ |
| 354 | #define LINKTYPE_GPF_F 171 /* GPF-T (ITU-T G.7041/Y.1303) */ |
| 355 | |
| 356 | /* |
| 357 | * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line |
| 358 | * monitoring equipment. |
| 359 | */ |
| 360 | #define LINKTYPE_GCOM_T1E1 172 |
| 361 | #define LINKTYPE_GCOM_SERIAL 173 |
| 362 | |
| 363 | /* |
| 364 | * Juniper-private data link type, as per request from |
| 365 | * Hannes Gredler <hannes@juniper.net>. The DLT_ is used |
| 366 | * for internal communication to Physical Interface Cards (PIC) |
| 367 | */ |
| 368 | #define LINKTYPE_JUNIPER_PIC_PEER 174 |
| 369 | |
| 370 | /* |
| 371 | * Link types requested by Gregor Maier <gregor@endace.com> of Endace |
| 372 | * Measurement Systems. They add an ERF header (see |
| 373 | * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of |
| 374 | * the link-layer header. |
| 375 | */ |
| 376 | #define LINKTYPE_ERF_ETH 175 /* Ethernet */ |
| 377 | #define LINKTYPE_ERF_POS 176 /* Packet-over-SONET */ |
| 378 | |
| 379 | /* |
| 380 | * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD |
| 381 | * for vISDN (http://www.orlandi.com/visdn/). Its link-layer header |
| 382 | * includes additional information before the LAPD header, so it's |
| 383 | * not necessarily a generic LAPD header. |
| 384 | */ |
| 385 | #define LINKTYPE_LINUX_LAPD 177 |
| 386 | |
| 387 | /* |
| 388 | * Juniper-private data link type, as per request from |
| 389 | * Hannes Gredler <hannes@juniper.net>. |
| 390 | * The Link Types are used for prepending meta-information |
| 391 | * like interface index, interface name |
| 392 | * before standard Ethernet, PPP, Frelay & C-HDLC Frames |
| 393 | */ |
| 394 | #define LINKTYPE_JUNIPER_ETHER 178 |
| 395 | #define LINKTYPE_JUNIPER_PPP 179 |
| 396 | #define LINKTYPE_JUNIPER_FRELAY 180 |
| 397 | #define LINKTYPE_JUNIPER_CHDLC 181 |
| 398 | |
| 399 | /* |
| 400 | * Multi Link Frame Relay (FRF.16) |
| 401 | */ |
| 402 | #define LINKTYPE_MFR 182 |
| 403 | |
| 404 | /* |
| 405 | * Juniper-private data link type, as per request from |
| 406 | * Hannes Gredler <hannes@juniper.net>. |
| 407 | * The DLT_ is used for internal communication with a |
| 408 | * voice Adapter Card (PIC) |
| 409 | */ |
| 410 | #define LINKTYPE_JUNIPER_VP 183 |
| 411 | |
| 412 | /* |
| 413 | * Arinc 429 frames. |
| 414 | * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. |
| 415 | * Every frame contains a 32bit A429 label. |
| 416 | * More documentation on Arinc 429 can be found at |
| 417 | * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf |
| 418 | */ |
| 419 | #define LINKTYPE_A429 184 |
| 420 | |
| 421 | /* |
| 422 | * Arinc 653 Interpartition Communication messages. |
| 423 | * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. |
| 424 | * Please refer to the A653-1 standard for more information. |
| 425 | */ |
| 426 | #define LINKTYPE_A653_ICM 185 |
| 427 | |
| 428 | /* |
| 429 | * USB packets, beginning with a USB setup header; requested by |
| 430 | * Paolo Abeni <paolo.abeni@email.it>. |
| 431 | */ |
| 432 | #define LINKTYPE_USB 186 |
| 433 | |
| 434 | /* |
| 435 | * Bluetooth HCI UART transport layer (part H:4); requested by |
| 436 | * Paolo Abeni. |
| 437 | */ |
| 438 | #define LINKTYPE_BLUETOOTH_HCI_H4 187 |
| 439 | |
| 440 | /* |
| 441 | * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz |
| 442 | * <cruz_petagay@bah.com>. |
| 443 | */ |
| 444 | #define LINKTYPE_IEEE802_16_MAC_CPS 188 |
| 445 | |
| 446 | /* |
| 447 | * USB packets, beginning with a Linux USB header; requested by |
| 448 | * Paolo Abeni <paolo.abeni@email.it>. |
| 449 | */ |
| 450 | #define LINKTYPE_USB_LINUX 189 |
| 451 | |
| 452 | /* |
| 453 | * Controller Area Network (CAN) v. 2.0B packets. |
| 454 | * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. |
| 455 | * Used to dump CAN packets coming from a CAN Vector board. |
| 456 | * More documentation on the CAN v2.0B frames can be found at |
| 457 | * http://www.can-cia.org/downloads/?269 |
| 458 | */ |
| 459 | #define LINKTYPE_CAN20B 190 |
| 460 | |
| 461 | /* |
| 462 | * IEEE 802.15.4, with address fields padded, as is done by Linux |
| 463 | * drivers; requested by Juergen Schimmer. |
| 464 | */ |
| 465 | #define LINKTYPE_IEEE802_15_4_LINUX 191 |
| 466 | |
| 467 | /* |
| 468 | * Per Packet Information encapsulated packets. |
| 469 | * LINKTYPE_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. |
| 470 | */ |
| 471 | #define LINKTYPE_PPI 192 |
| 472 | |
| 473 | /* |
| 474 | * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header; |
| 475 | * requested by Charles Clancy. |
| 476 | */ |
| 477 | #define LINKTYPE_IEEE802_16_MAC_CPS_RADIO 193 |
| 478 | |
| 479 | /* |
| 480 | * Juniper-private data link type, as per request from |
| 481 | * Hannes Gredler <hannes@juniper.net>. |
| 482 | * The DLT_ is used for internal communication with a |
| 483 | * integrated service module (ISM). |
| 484 | */ |
| 485 | #define LINKTYPE_JUNIPER_ISM 194 |
| 486 | |
| 487 | /* |
| 488 | * IEEE 802.15.4, exactly as it appears in the spec (no padding, no |
| 489 | * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>. |
| 490 | */ |
| 491 | #define LINKTYPE_IEEE802_15_4 195 |
| 492 | |
| 493 | /* |
| 494 | * Various link-layer types, with a pseudo-header, for SITA |
| 495 | * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com). |
| 496 | */ |
| 497 | #define LINKTYPE_SITA 196 |
| 498 | |
| 499 | /* |
| 500 | * Various link-layer types, with a pseudo-header, for Endace DAG cards; |
| 501 | * encapsulates Endace ERF records. Requested by Stephen Donnelly |
| 502 | * <stephen@endace.com>. |
| 503 | */ |
| 504 | #define LINKTYPE_ERF 197 |
| 505 | |
| 506 | /* |
| 507 | * Special header prepended to Ethernet packets when capturing from a |
| 508 | * u10 Networks board. Requested by Phil Mulholland |
| 509 | * <phil@u10networks.com>. |
| 510 | */ |
| 511 | #define LINKTYPE_RAIF1 198 |
| 512 | |
| 513 | /* |
| 514 | * IPMB packet for IPMI, beginning with the I2C slave address, followed |
| 515 | * by the netFn and LUN, etc.. Requested by Chanthy Toeung |
| 516 | * <chanthy.toeung@ca.kontron.com>. |
| 517 | */ |
| 518 | #define LINKTYPE_IPMB 199 |
| 519 | |
| 520 | /* |
| 521 | * Juniper-private data link type, as per request from |
| 522 | * Hannes Gredler <hannes@juniper.net>. |
| 523 | * The DLT_ is used for capturing data on a secure tunnel interface. |
| 524 | */ |
| 525 | #define LINKTYPE_JUNIPER_ST 200 |
| 526 | |
| 527 | /* |
| 528 | * Bluetooth HCI UART transport layer (part H:4), with pseudo-header |
| 529 | * that includes direction information; requested by Paolo Abeni. |
| 530 | */ |
| 531 | #define LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR 201 |
| 532 | |
| 533 | /* |
| 534 | * AX.25 packet with a 1-byte KISS header; see |
| 535 | * |
| 536 | * http://www.ax25.net/kiss.htm |
| 537 | * |
| 538 | * as per Richard Stearn <richard@rns-stearn.demon.co.uk>. |
| 539 | */ |
| 540 | #define LINKTYPE_AX25_KISS 202 |
| 541 | |
| 542 | /* |
| 543 | * LAPD packets from an ISDN channel, starting with the address field, |
| 544 | * with no pseudo-header. |
| 545 | * Requested by Varuna De Silva <varunax@gmail.com>. |
| 546 | */ |
| 547 | #define LINKTYPE_LAPD 203 |
| 548 | |
| 549 | /* |
| 550 | * Variants of various link-layer headers, with a one-byte direction |
| 551 | * pseudo-header prepended - zero means "received by this host", |
| 552 | * non-zero (any non-zero value) means "sent by this host" - as per |
| 553 | * Will Barker <w.barker@zen.co.uk>. |
| 554 | */ |
| 555 | #define LINKTYPE_PPP_WITH_DIR 204 /* PPP */ |
| 556 | #define LINKTYPE_C_HDLC_WITH_DIR 205 /* Cisco HDLC */ |
| 557 | #define LINKTYPE_FRELAY_WITH_DIR 206 /* Frame Relay */ |
| 558 | #define LINKTYPE_LAPB_WITH_DIR 207 /* LAPB */ |
| 559 | |
| 560 | /* |
| 561 | * 208 is reserved for an as-yet-unspecified proprietary link-layer |
| 562 | * type, as requested by Will Barker. |
| 563 | */ |
| 564 | |
| 565 | /* |
| 566 | * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman |
| 567 | * <avn@pigeonpoint.com>. |
| 568 | */ |
| 569 | #define LINKTYPE_IPMB_LINUX 209 |
| 570 | |
| 571 | /* |
| 572 | * FlexRay automotive bus - http://www.flexray.com/ - as requested |
| 573 | * by Hannes Kaelber <hannes.kaelber@x2e.de>. |
| 574 | */ |
| 575 | #define LINKTYPE_FLEXRAY 210 |
| 576 | |
| 577 | /* |
| 578 | * Media Oriented Systems Transport (MOST) bus for multimedia |
| 579 | * transport - http://www.mostcooperation.com/ - as requested |
| 580 | * by Hannes Kaelber <hannes.kaelber@x2e.de>. |
| 581 | */ |
| 582 | #define LINKTYPE_MOST 211 |
| 583 | |
| 584 | /* |
| 585 | * Local Interconnect Network (LIN) bus for vehicle networks - |
| 586 | * http://www.lin-subbus.org/ - as requested by Hannes Kaelber |
| 587 | * <hannes.kaelber@x2e.de>. |
| 588 | */ |
| 589 | #define LINKTYPE_LIN 212 |
| 590 | |
| 591 | /* |
| 592 | * X2E-private data link type used for serial line capture, |
| 593 | * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>. |
| 594 | */ |
| 595 | #define LINKTYPE_X2E_SERIAL 213 |
| 596 | |
| 597 | /* |
| 598 | * X2E-private data link type used for the Xoraya data logger |
| 599 | * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>. |
| 600 | */ |
| 601 | #define LINKTYPE_X2E_XORAYA 214 |
| 602 | |
| 603 | /* |
| 604 | * IEEE 802.15.4, exactly as it appears in the spec (no padding, no |
| 605 | * nothing), but with the PHY-level data for non-ASK PHYs (4 octets |
| 606 | * of 0 as preamble, one octet of SFD, one octet of frame length+ |
| 607 | * reserved bit, and then the MAC-layer data, starting with the |
| 608 | * frame control field). |
| 609 | * |
| 610 | * Requested by Max Filippov <jcmvbkbc@gmail.com>. |
| 611 | */ |
| 612 | #define LINKTYPE_IEEE802_15_4_NONASK_PHY 215 |
| 613 | |
| 614 | /* |
| 615 | * David Gibson <david@gibson.dropbear.id.au> requested this for |
| 616 | * captures from the Linux kernel /dev/input/eventN devices. This |
| 617 | * is used to communicate keystrokes and mouse movements from the |
| 618 | * Linux kernel to display systems, such as Xorg. |
| 619 | */ |
| 620 | #define LINKTYPE_LINUX_EVDEV 216 |
| 621 | |
| 622 | /* |
| 623 | * GSM Um and Abis interfaces, preceded by a "gsmtap" header. |
| 624 | * |
| 625 | * Requested by Harald Welte <laforge@gnumonks.org>. |
| 626 | */ |
| 627 | #define LINKTYPE_GSMTAP_UM 217 |
| 628 | #define LINKTYPE_GSMTAP_ABIS 218 |
| 629 | |
| 630 | /* |
| 631 | * MPLS, with an MPLS label as the link-layer header. |
| 632 | * Requested by Michele Marchetto <michele@openbsd.org> on behalf |
| 633 | * of OpenBSD. |
| 634 | */ |
| 635 | #define LINKTYPE_MPLS 219 |
| 636 | |
| 637 | /* |
| 638 | * USB packets, beginning with a Linux USB header, with the USB header |
| 639 | * padded to 64 bytes; required for memory-mapped access. |
| 640 | */ |
| 641 | #define LINKTYPE_USB_LINUX_MMAPPED 220 |
| 642 | |
| 643 | /* |
| 644 | * DECT packets, with a pseudo-header; requested by |
| 645 | * Matthias Wenzel <tcpdump@mazzoo.de>. |
| 646 | */ |
| 647 | #define LINKTYPE_DECT 221 |
| 648 | |
| 649 | /* |
| 650 | * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov> |
| 651 | * Date: Mon, 11 May 2009 11:18:30 -0500 |
| 652 | * |
| 653 | * DLT_AOS. We need it for AOS Space Data Link Protocol. |
| 654 | * I have already written dissectors for but need an OK from |
| 655 | * legal before I can submit a patch. |
| 656 | * |
| 657 | */ |
| 658 | #define LINKTYPE_AOS 222 |
| 659 | |
| 660 | /* |
| 661 | * Wireless HART (Highway Addressable Remote Transducer) |
| 662 | * From the HART Communication Foundation |
| 663 | * IES/PAS 62591 |
| 664 | * |
| 665 | * Requested by Sam Roberts <vieuxtech@gmail.com>. |
| 666 | */ |
| 667 | #define LINKTYPE_WIHART 223 |
| 668 | |
| 669 | /* |
| 670 | * Fibre Channel FC-2 frames, beginning with a Frame_Header. |
| 671 | * Requested by Kahou Lei <kahou82@gmail.com>. |
| 672 | */ |
| 673 | #define LINKTYPE_FC_2 224 |
| 674 | |
| 675 | /* |
| 676 | * Fibre Channel FC-2 frames, beginning with an encoding of the |
| 677 | * SOF, and ending with an encoding of the EOF. |
| 678 | * |
| 679 | * The encodings represent the frame delimiters as 4-byte sequences |
| 680 | * representing the corresponding ordered sets, with K28.5 |
| 681 | * represented as 0xBC, and the D symbols as the corresponding |
| 682 | * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2, |
| 683 | * is represented as 0xBC 0xB5 0x55 0x55. |
| 684 | * |
| 685 | * Requested by Kahou Lei <kahou82@gmail.com>. |
| 686 | */ |
| 687 | #define LINKTYPE_FC_2_WITH_FRAME_DELIMS 225 |
| 688 | |
| 689 | /* |
| 690 | * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>. |
| 691 | * |
| 692 | * The pseudo-header starts with a one-byte version number; for version 2, |
| 693 | * the pseudo-header is: |
| 694 | * |
| 695 | * struct dl_ipnetinfo { |
| 696 | * u_int8_t dli_version; |
| 697 | * u_int8_t dli_family; |
| 698 | * u_int16_t dli_htype; |
| 699 | * u_int32_t dli_pktlen; |
| 700 | * u_int32_t dli_ifindex; |
| 701 | * u_int32_t dli_grifindex; |
| 702 | * u_int32_t dli_zsrc; |
| 703 | * u_int32_t dli_zdst; |
| 704 | * }; |
| 705 | * |
| 706 | * dli_version is 2 for the current version of the pseudo-header. |
| 707 | * |
| 708 | * dli_family is a Solaris address family value, so it's 2 for IPv4 |
| 709 | * and 26 for IPv6. |
| 710 | * |
| 711 | * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing |
| 712 | * packets, and 2 for packets arriving from another zone on the same |
| 713 | * machine. |
| 714 | * |
| 715 | * dli_pktlen is the length of the packet data following the pseudo-header |
| 716 | * (so the captured length minus dli_pktlen is the length of the |
| 717 | * pseudo-header, assuming the entire pseudo-header was captured). |
| 718 | * |
| 719 | * dli_ifindex is the interface index of the interface on which the |
| 720 | * packet arrived. |
| 721 | * |
| 722 | * dli_grifindex is the group interface index number (for IPMP interfaces). |
| 723 | * |
| 724 | * dli_zsrc is the zone identifier for the source of the packet. |
| 725 | * |
| 726 | * dli_zdst is the zone identifier for the destination of the packet. |
| 727 | * |
| 728 | * A zone number of 0 is the global zone; a zone number of 0xffffffff |
| 729 | * means that the packet arrived from another host on the network, not |
| 730 | * from another zone on the same machine. |
| 731 | * |
| 732 | * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates |
| 733 | * which of those it is. |
| 734 | */ |
| 735 | #define LINKTYPE_IPNET 226 |
| 736 | |
| 737 | /* |
| 738 | * CAN (Controller Area Network) frames, with a pseudo-header as supplied |
| 739 | * by Linux SocketCAN. See Documentation/networking/can.txt in the Linux |
| 740 | * source. |
| 741 | * |
| 742 | * Requested by Felix Obenhuber <felix@obenhuber.de>. |
| 743 | */ |
| 744 | #define LINKTYPE_CAN_SOCKETCAN 227 |
| 745 | |
| 746 | /* |
| 747 | * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies |
| 748 | * whether it's v4 or v6. Requested by Darren Reed <Darren.Reed@Sun.COM>. |
| 749 | */ |
| 750 | #define LINKTYPE_IPV4 228 |
| 751 | #define LINKTYPE_IPV6 229 |
| 752 | |
| 753 | /* |
| 754 | * IEEE 802.15.4, exactly as it appears in the spec (no padding, no |
| 755 | * nothing), and with no FCS at the end of the frame; requested by |
| 756 | * Jon Smirl <jonsmirl@gmail.com>. |
| 757 | */ |
| 758 | #define LINKTYPE_IEEE802_15_4_NOFCS 230 |
| 759 | |
| 760 | /* |
| 761 | * Raw D-Bus: |
| 762 | * |
| 763 | * http://www.freedesktop.org/wiki/Software/dbus |
| 764 | * |
| 765 | * messages: |
| 766 | * |
| 767 | * http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages |
| 768 | * |
| 769 | * starting with the endianness flag, followed by the message type, etc., |
| 770 | * but without the authentication handshake before the message sequence: |
| 771 | * |
| 772 | * http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol |
| 773 | * |
| 774 | * Requested by Martin Vidner <martin@vidner.net>. |
| 775 | */ |
| 776 | #define LINKTYPE_DBUS 231 |
| 777 | |
| 778 | /* |
| 779 | * Juniper-private data link type, as per request from |
| 780 | * Hannes Gredler <hannes@juniper.net>. |
| 781 | */ |
| 782 | #define LINKTYPE_JUNIPER_VS 232 |
| 783 | #define LINKTYPE_JUNIPER_SRX_E2E 233 |
| 784 | #define LINKTYPE_JUNIPER_FIBRECHANNEL 234 |
| 785 | |
| 786 | /* |
| 787 | * DVB-CI (DVB Common Interface for communication between a PC Card |
| 788 | * module and a DVB receiver). See |
| 789 | * |
| 790 | * http://www.kaiser.cx/pcap-dvbci.html |
| 791 | * |
| 792 | * for the specification. |
| 793 | * |
| 794 | * Requested by Martin Kaiser <martin@kaiser.cx>. |
| 795 | */ |
| 796 | #define LINKTYPE_DVB_CI 235 |
| 797 | |
| 798 | /* |
| 799 | * Variant of 3GPP TS 27.010 multiplexing protocol. Requested |
| 800 | * by Hans-Christoph Schemmel <hans-christoph.schemmel@cinterion.com>. |
| 801 | */ |
| 802 | #define LINKTYPE_MUX27010 236 |
| 803 | |
| 804 | /* |
| 805 | * STANAG 5066 D_PDUs. Requested by M. Baris Demiray |
| 806 | * <barisdemiray@gmail.com>. |
| 807 | */ |
| 808 | #define LINKTYPE_STANAG_5066_D_PDU 237 |
| 809 | |
| 810 | /* |
| 811 | * Juniper-private data link type, as per request from |
| 812 | * Hannes Gredler <hannes@juniper.net>. |
| 813 | */ |
| 814 | #define LINKTYPE_JUNIPER_ATM_CEMIC 238 |
| 815 | |
| 816 | /* |
| 817 | * NetFilter LOG messages |
| 818 | * (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets) |
| 819 | * |
| 820 | * Requested by Jakub Zawadzki <darkjames-ws@darkjames.pl> |
| 821 | */ |
| 822 | #define LINKTYPE_NFLOG 239 |
| 823 | |
| 824 | /* |
| 825 | * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type |
| 826 | * for Ethernet packets with a 4-byte pseudo-header and always |
| 827 | * with the payload including the FCS, as supplied by their |
| 828 | * netANALYZER hardware and software. |
| 829 | * |
| 830 | * Requested by Holger P. Frommer <HPfrommer@hilscher.com> |
| 831 | */ |
| 832 | #define LINKTYPE_NETANALYZER 240 |
| 833 | |
| 834 | /* |
| 835 | * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type |
| 836 | * for Ethernet packets with a 4-byte pseudo-header and FCS and |
| 837 | * 1 byte of SFD, as supplied by their netANALYZER hardware and |
| 838 | * software. |
| 839 | * |
| 840 | * Requested by Holger P. Frommer <HPfrommer@hilscher.com> |
| 841 | */ |
| 842 | #define LINKTYPE_NETANALYZER_TRANSPARENT 241 |
| 843 | |
| 844 | /* |
| 845 | * IP-over-InfiniBand, as specified by RFC 4391. |
| 846 | * |
| 847 | * Requested by Petr Sumbera <petr.sumbera@oracle.com>. |
| 848 | */ |
| 849 | #define LINKTYPE_IPOIB 242 |
| 850 | |
| 851 | /* |
| 852 | * MPEG-2 transport stream (ISO 13818-1/ITU-T H.222.0). |
| 853 | * |
| 854 | * Requested by Guy Martin <gmsoft@tuxicoman.be>. |
| 855 | */ |
| 856 | #define LINKTYPE_MPEG_2_TS 243 |
| 857 | |
| 858 | /* |
| 859 | * ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as |
| 860 | * used by their ng40 protocol tester. |
| 861 | * |
| 862 | * Requested by Jens Grimmer <jens.grimmer@ng4t.com>. |
| 863 | */ |
| 864 | #define LINKTYPE_NG40 244 |
| 865 | |
| 866 | /* |
| 867 | * Pseudo-header giving adapter number and flags, followed by an NFC |
| 868 | * (Near-Field Communications) Logical Link Control Protocol (LLCP) PDU, |
| 869 | * as specified by NFC Forum Logical Link Control Protocol Technical |
| 870 | * Specification LLCP 1.1. |
| 871 | * |
| 872 | * Requested by Mike Wakerly <mikey@google.com>. |
| 873 | */ |
| 874 | #define LINKTYPE_NFC_LLCP 245 |
| 875 | |
| 876 | /* |
| 877 | * pfsync output; DLT_PFSYNC is 18, which collides with DLT_CIP in |
| 878 | * SuSE 6.3, on OpenBSD, NetBSD, DragonFly BSD, and Mac OS X, and |
| 879 | * is 121, which collides with DLT_HHDLC, in FreeBSD. We pick a |
| 880 | * shiny new link-layer header type value that doesn't collide with |
| 881 | * anything, in the hopes that future pfsync savefiles, if any, |
| 882 | * won't require special hacks to distinguish from other savefiles. |
| 883 | * |
| 884 | */ |
| 885 | #define LINKTYPE_PFSYNC 246 |
| 886 | |
| 887 | /* |
| 888 | * Raw InfiniBand packets, starting with the Local Routing Header. |
| 889 | * |
| 890 | * Requested by Oren Kladnitsky <orenk@mellanox.com>. |
| 891 | */ |
| 892 | #define LINKTYPE_INFINIBAND 247 |
| 893 | |
| 894 | /* |
| 895 | * SCTP, with no lower-level protocols (i.e., no IPv4 or IPv6). |
| 896 | * |
| 897 | * Requested by Michael Tuexen <Michael.Tuexen@lurchi.franken.de>. |
| 898 | */ |
| 899 | #define LINKTYPE_SCTP 248 |
| 900 | |
| 901 | /* |
| 902 | * USB packets, beginning with a USBPcap header. |
| 903 | * |
| 904 | * Requested by Tomasz Mon <desowin@gmail.com> |
| 905 | */ |
| 906 | #define LINKTYPE_USBPCAP 249 |
| 907 | |
| 908 | /* |
| 909 | * Schweitzer Engineering Laboratories "RTAC" product serial-line |
| 910 | * packets. |
| 911 | * |
| 912 | * Requested by Chris Bontje <chris_bontje@selinc.com>. |
| 913 | */ |
| 914 | #define DLT_RTAC_SERIAL 250 |
| 915 | |
| 916 | /* |
| 917 | * Bluetooth Low Energy air interface link-layer packets. |
| 918 | * |
| 919 | * Requested by Mike Kershaw <dragorn@kismetwireless.net>. |
| 920 | */ |
| 921 | #define LINKTYPE_BLUETOOTH_LE_LL 251 |
| 922 | |
| 923 | /* |
| 924 | * Link-layer header type for upper-protocol layer PDU saves from wireshark. |
| 925 | * |
| 926 | * the actual contents are determined by two TAGs stored with each |
| 927 | * packet: |
| 928 | * EXP_PDU_TAG_LINKTYPE the link type (LINKTYPE_ value) of the |
| 929 | * original packet. |
| 930 | * |
| 931 | * EXP_PDU_TAG_PROTO_NAME the name of the wireshark dissector |
| 932 | * that can make sense of the data stored. |
| 933 | */ |
| 934 | #define LINKTYPE_WIRESHARK_UPPER_PDU 252 |
| 935 | |
| 936 | #define LINKTYPE_MATCHING_MAX 252 /* highest value in the "matching" range */ |
| 937 | |
| 938 | static struct linktype_map { |
| 939 | int dlt; |
| 940 | int linktype; |
| 941 | } map[] = { |
| 942 | /* |
| 943 | * These DLT_* codes have LINKTYPE_* codes with values identical |
| 944 | * to the values of the corresponding DLT_* code. |
| 945 | */ |
| 946 | { DLT_NULL, LINKTYPE_NULL }, |
| 947 | { DLT_EN10MB, LINKTYPE_ETHERNET }, |
| 948 | { DLT_EN3MB, LINKTYPE_EXP_ETHERNET }, |
| 949 | { DLT_AX25, LINKTYPE_AX25 }, |
| 950 | { DLT_PRONET, LINKTYPE_PRONET }, |
| 951 | { DLT_CHAOS, LINKTYPE_CHAOS }, |
| 952 | { DLT_IEEE802, LINKTYPE_IEEE802_5 }, |
| 953 | { DLT_ARCNET, LINKTYPE_ARCNET_BSD }, |
| 954 | { DLT_SLIP, LINKTYPE_SLIP }, |
| 955 | { DLT_PPP, LINKTYPE_PPP }, |
| 956 | { DLT_FDDI, LINKTYPE_FDDI }, |
| 957 | { DLT_SYMANTEC_FIREWALL, LINKTYPE_SYMANTEC_FIREWALL }, |
| 958 | |
| 959 | /* |
| 960 | * These DLT_* codes have different values on different |
| 961 | * platforms; we map them to LINKTYPE_* codes that |
| 962 | * have values that should never be equal to any DLT_* |
| 963 | * code. |
| 964 | */ |
| 965 | #ifdef DLT_FR |
| 966 | /* BSD/OS Frame Relay */ |
| 967 | { DLT_FR, LINKTYPE_FRELAY }, |
| 968 | #endif |
| 969 | |
| 970 | { DLT_ATM_RFC1483, LINKTYPE_ATM_RFC1483 }, |
| 971 | { DLT_RAW, LINKTYPE_RAW }, |
| 972 | { DLT_SLIP_BSDOS, LINKTYPE_SLIP_BSDOS }, |
| 973 | { DLT_PPP_BSDOS, LINKTYPE_PPP_BSDOS }, |
| 974 | |
| 975 | /* BSD/OS Cisco HDLC */ |
| 976 | { DLT_C_HDLC, LINKTYPE_C_HDLC }, |
| 977 | |
| 978 | /* |
| 979 | * These DLT_* codes are not on all platforms, but, so far, |
| 980 | * there don't appear to be any platforms that define |
| 981 | * other codes with those values; we map them to |
| 982 | * different LINKTYPE_* values anyway, just in case. |
| 983 | */ |
| 984 | |
| 985 | /* Linux ATM Classical IP */ |
| 986 | { DLT_ATM_CLIP, LINKTYPE_ATM_CLIP }, |
| 987 | |
| 988 | /* NetBSD sync/async serial PPP (or Cisco HDLC) */ |
| 989 | { DLT_PPP_SERIAL, LINKTYPE_PPP_HDLC }, |
| 990 | |
| 991 | /* NetBSD PPP over Ethernet */ |
| 992 | { DLT_PPP_ETHER, LINKTYPE_PPP_ETHER }, |
| 993 | |
| 994 | /* |
| 995 | * All LINKTYPE_ values between LINKTYPE_MATCHING_MIN |
| 996 | * and LINKTYPE_MATCHING_MAX are mapped to identical |
| 997 | * DLT_ values. |
| 998 | */ |
| 999 | |
| 1000 | { -1, -1 } |
| 1001 | }; |
| 1002 | |
| 1003 | int |
| 1004 | dlt_to_linktype(int dlt) |
| 1005 | { |
| 1006 | int i; |
| 1007 | |
| 1008 | /* |
| 1009 | * Map DLT_PFSYNC, whatever it might be, to LINKTYPE_PFSYNC. |
| 1010 | */ |
| 1011 | if (dlt == DLT_PFSYNC) |
| 1012 | return (LINKTYPE_PFSYNC); |
| 1013 | |
| 1014 | /* |
| 1015 | * Map the values in the matching range. |
| 1016 | */ |
| 1017 | if (dlt >= DLT_MATCHING_MIN && dlt <= DLT_MATCHING_MAX) |
| 1018 | return (dlt); |
| 1019 | |
| 1020 | /* |
| 1021 | * Map the values outside that range. |
| 1022 | */ |
| 1023 | for (i = 0; map[i].dlt != -1; i++) { |
| 1024 | if (map[i].dlt == dlt) |
| 1025 | return (map[i].linktype); |
| 1026 | } |
| 1027 | |
| 1028 | /* |
| 1029 | * If we don't have a mapping for this DLT_ code, return an |
| 1030 | * error; that means that this is a value with no corresponding |
| 1031 | * LINKTYPE_ code, and we need to assign one. |
| 1032 | */ |
| 1033 | return (-1); |
| 1034 | } |
| 1035 | |
| 1036 | int |
| 1037 | linktype_to_dlt(int linktype) |
| 1038 | { |
| 1039 | int i; |
| 1040 | |
| 1041 | /* |
| 1042 | * Map LINKTYPE_PFSYNC to DLT_PFSYNC, whatever it might be. |
| 1043 | * LINKTYPE_PFSYNC is in the matching range, to make sure |
| 1044 | * it's as safe from reuse as we can arrange, so we do |
| 1045 | * this test first. |
| 1046 | */ |
| 1047 | if (linktype == LINKTYPE_PFSYNC) |
| 1048 | return (DLT_PFSYNC); |
| 1049 | |
| 1050 | /* |
| 1051 | * Map the values in the matching range. |
| 1052 | */ |
| 1053 | if (linktype >= LINKTYPE_MATCHING_MIN && |
| 1054 | linktype <= LINKTYPE_MATCHING_MAX) |
| 1055 | return (linktype); |
| 1056 | |
| 1057 | /* |
| 1058 | * Map the values outside that range. |
| 1059 | */ |
| 1060 | for (i = 0; map[i].linktype != -1; i++) { |
| 1061 | if (map[i].linktype == linktype) |
| 1062 | return (map[i].dlt); |
| 1063 | } |
| 1064 | |
| 1065 | /* |
| 1066 | * If we don't have an entry for this link type, return |
| 1067 | * the link type value; it may be a DLT_ value from an |
| 1068 | * older version of libpcap. |
| 1069 | */ |
| 1070 | return linktype; |
| 1071 | } |
| 1072 | |
| 1073 | /* |
| 1074 | * The DLT_USB_LINUX and DLT_USB_LINUX_MMAPPED headers are in host |
| 1075 | * byte order when capturing (it's supplied directly from a |
| 1076 | * memory-mapped buffer shared by the kernel). |
| 1077 | * |
| 1078 | * When reading a DLT_USB_LINUX or DLT_USB_LINUX_MMAPPED capture file, |
| 1079 | * we need to convert it from the byte order of the host that wrote |
| 1080 | * the file to this host's byte order. |
| 1081 | */ |
| 1082 | static void |
| 1083 | swap_linux_usb_header(const struct pcap_pkthdr *hdr, u_char *buf, |
| 1084 | int header_len_64_bytes) |
| 1085 | { |
| 1086 | pcap_usb_header_mmapped *uhdr = (pcap_usb_header_mmapped *)buf; |
| 1087 | bpf_u_int32 offset = 0; |
| 1088 | usb_isodesc *pisodesc; |
| 1089 | int32_t numdesc, i; |
| 1090 | |
| 1091 | /* |
| 1092 | * "offset" is the offset *past* the field we're swapping; |
| 1093 | * we skip the field *before* checking to make sure |
| 1094 | * the captured data length includes the entire field. |
| 1095 | */ |
| 1096 | |
| 1097 | /* |
| 1098 | * The URB id is a totally opaque value; do we really need to |
| 1099 | * convert it to the reading host's byte order??? |
| 1100 | */ |
| 1101 | offset += 8; /* skip past id */ |
| 1102 | if (hdr->caplen < offset) |
| 1103 | return; |
| 1104 | uhdr->id = SWAPLL(uhdr->id); |
| 1105 | |
| 1106 | offset += 4; /* skip past various 1-byte fields */ |
| 1107 | |
| 1108 | offset += 2; /* skip past bus_id */ |
| 1109 | if (hdr->caplen < offset) |
| 1110 | return; |
| 1111 | uhdr->bus_id = SWAPSHORT(uhdr->bus_id); |
| 1112 | |
| 1113 | offset += 2; /* skip past various 1-byte fields */ |
| 1114 | |
| 1115 | offset += 8; /* skip past ts_sec */ |
| 1116 | if (hdr->caplen < offset) |
| 1117 | return; |
| 1118 | uhdr->ts_sec = SWAPLL(uhdr->ts_sec); |
| 1119 | |
| 1120 | offset += 4; /* skip past ts_usec */ |
| 1121 | if (hdr->caplen < offset) |
| 1122 | return; |
| 1123 | uhdr->ts_usec = SWAPLONG(uhdr->ts_usec); |
| 1124 | |
| 1125 | offset += 4; /* skip past status */ |
| 1126 | if (hdr->caplen < offset) |
| 1127 | return; |
| 1128 | uhdr->status = SWAPLONG(uhdr->status); |
| 1129 | |
| 1130 | offset += 4; /* skip past urb_len */ |
| 1131 | if (hdr->caplen < offset) |
| 1132 | return; |
| 1133 | uhdr->urb_len = SWAPLONG(uhdr->urb_len); |
| 1134 | |
| 1135 | offset += 4; /* skip past data_len */ |
| 1136 | if (hdr->caplen < offset) |
| 1137 | return; |
| 1138 | uhdr->data_len = SWAPLONG(uhdr->data_len); |
| 1139 | |
| 1140 | if (uhdr->transfer_type == URB_ISOCHRONOUS) { |
| 1141 | offset += 4; /* skip past s.iso.error_count */ |
| 1142 | if (hdr->caplen < offset) |
| 1143 | return; |
| 1144 | uhdr->s.iso.error_count = SWAPLONG(uhdr->s.iso.error_count); |
| 1145 | |
| 1146 | offset += 4; /* skip past s.iso.numdesc */ |
| 1147 | if (hdr->caplen < offset) |
| 1148 | return; |
| 1149 | uhdr->s.iso.numdesc = SWAPLONG(uhdr->s.iso.numdesc); |
| 1150 | } else |
| 1151 | offset += 8; /* skip USB setup header */ |
| 1152 | |
| 1153 | if (header_len_64_bytes) { |
| 1154 | /* |
| 1155 | * This is either the "version 1" header, with |
| 1156 | * 16 bytes of additional fields at the end, or |
| 1157 | * a "version 0" header from a memory-mapped |
| 1158 | * capture, with 16 bytes of zeroed-out padding |
| 1159 | * at the end. Byte swap them as if this were |
| 1160 | * a "version 1" header. |
| 1161 | */ |
| 1162 | offset += 4; /* skip past interval */ |
| 1163 | if (hdr->caplen < offset) |
| 1164 | return; |
| 1165 | uhdr->interval = SWAPLONG(uhdr->interval); |
| 1166 | |
| 1167 | offset += 4; /* skip past start_frame */ |
| 1168 | if (hdr->caplen < offset) |
| 1169 | return; |
| 1170 | uhdr->start_frame = SWAPLONG(uhdr->start_frame); |
| 1171 | |
| 1172 | offset += 4; /* skip past xfer_flags */ |
| 1173 | if (hdr->caplen < offset) |
| 1174 | return; |
| 1175 | uhdr->xfer_flags = SWAPLONG(uhdr->xfer_flags); |
| 1176 | |
| 1177 | offset += 4; /* skip past ndesc */ |
| 1178 | if (hdr->caplen < offset) |
| 1179 | return; |
| 1180 | uhdr->ndesc = SWAPLONG(uhdr->ndesc); |
| 1181 | } |
| 1182 | |
| 1183 | if (uhdr->transfer_type == URB_ISOCHRONOUS) { |
| 1184 | /* swap the values in struct linux_usb_isodesc */ |
| 1185 | pisodesc = (usb_isodesc *)(void *)(buf+offset); |
| 1186 | numdesc = uhdr->s.iso.numdesc; |
| 1187 | for (i = 0; i < numdesc; i++) { |
| 1188 | offset += 4; /* skip past status */ |
| 1189 | if (hdr->caplen < offset) |
| 1190 | return; |
| 1191 | pisodesc->status = SWAPLONG(pisodesc->status); |
| 1192 | |
| 1193 | offset += 4; /* skip past offset */ |
| 1194 | if (hdr->caplen < offset) |
| 1195 | return; |
| 1196 | pisodesc->offset = SWAPLONG(pisodesc->offset); |
| 1197 | |
| 1198 | offset += 4; /* skip past len */ |
| 1199 | if (hdr->caplen < offset) |
| 1200 | return; |
| 1201 | pisodesc->len = SWAPLONG(pisodesc->len); |
| 1202 | |
| 1203 | offset += 4; /* skip past padding */ |
| 1204 | |
| 1205 | pisodesc++; |
| 1206 | } |
| 1207 | } |
| 1208 | } |
| 1209 | |
| 1210 | /* |
| 1211 | * The DLT_NFLOG "packets" have a mixture of big-endian and host-byte-order |
| 1212 | * data. They begin with a fixed-length header with big-endian fields, |
| 1213 | * followed by a set of TLVs, where the type and length are in host |
| 1214 | * byte order but the values are either big-endian or are a raw byte |
| 1215 | * sequence that's the same regardless of the host's byte order. |
| 1216 | * |
| 1217 | * When reading a DLT_NFLOG capture file, we need to convert the type |
| 1218 | * and length values from the byte order of the host that wrote the |
| 1219 | * file to the byte order of this host. |
| 1220 | */ |
| 1221 | static void |
| 1222 | swap_nflog_header(const struct pcap_pkthdr *hdr, u_char *buf) |
| 1223 | { |
| 1224 | u_char *p = buf; |
| 1225 | nflog_hdr_t *nfhdr = (nflog_hdr_t *)buf; |
| 1226 | nflog_tlv_t *tlv; |
| 1227 | u_int caplen = hdr->caplen; |
| 1228 | u_int length = hdr->len; |
| 1229 | u_int16_t size; |
| 1230 | |
| 1231 | if (caplen < (int) sizeof(nflog_hdr_t) || length < (int) sizeof(nflog_hdr_t)) { |
| 1232 | /* Not enough data to have any TLVs. */ |
| 1233 | return; |
| 1234 | } |
| 1235 | |
| 1236 | if (!(nfhdr->nflog_version) == 0) { |
| 1237 | /* Unknown NFLOG version */ |
| 1238 | return; |
| 1239 | } |
| 1240 | |
| 1241 | length -= sizeof(nflog_hdr_t); |
| 1242 | caplen -= sizeof(nflog_hdr_t); |
| 1243 | p += sizeof(nflog_hdr_t); |
| 1244 | |
| 1245 | while (caplen >= sizeof(nflog_tlv_t)) { |
| 1246 | tlv = (nflog_tlv_t *) p; |
| 1247 | |
| 1248 | /* Swap the type and length. */ |
| 1249 | tlv->tlv_type = SWAPSHORT(tlv->tlv_type); |
| 1250 | tlv->tlv_length = SWAPSHORT(tlv->tlv_length); |
| 1251 | |
| 1252 | /* Get the length of the TLV. */ |
| 1253 | size = tlv->tlv_length; |
| 1254 | if (size % 4 != 0) |
| 1255 | size += 4 - size % 4; |
| 1256 | |
| 1257 | /* Is the TLV's length less than the minimum? */ |
| 1258 | if (size < sizeof(nflog_tlv_t)) { |
| 1259 | /* Yes. Give up now. */ |
| 1260 | return; |
| 1261 | } |
| 1262 | |
| 1263 | /* Do we have enough data for the full TLV? */ |
| 1264 | if (caplen < size || length < size) { |
| 1265 | /* No. */ |
| 1266 | return; |
| 1267 | } |
| 1268 | |
| 1269 | /* Skip over the TLV. */ |
| 1270 | length -= size; |
| 1271 | caplen -= size; |
| 1272 | p += size; |
| 1273 | } |
| 1274 | } |
| 1275 | |
| 1276 | void |
| 1277 | swap_pseudo_headers(int linktype, struct pcap_pkthdr *hdr, u_char *data) |
| 1278 | { |
| 1279 | /* |
| 1280 | * Convert pseudo-headers from the byte order of |
| 1281 | * the host on which the file was saved to our |
| 1282 | * byte order, as necessary. |
| 1283 | */ |
| 1284 | switch (linktype) { |
| 1285 | |
| 1286 | case DLT_USB_LINUX: |
| 1287 | swap_linux_usb_header(hdr, data, 0); |
| 1288 | break; |
| 1289 | |
| 1290 | case DLT_USB_LINUX_MMAPPED: |
| 1291 | swap_linux_usb_header(hdr, data, 1); |
| 1292 | break; |
| 1293 | |
| 1294 | case DLT_NFLOG: |
| 1295 | swap_nflog_header(hdr, data); |
| 1296 | break; |
| 1297 | } |
| 1298 | } |