| pcap-bpf.h (127664) | pcap-bpf.h (146768) |
|---|---|
| 1/*- 2 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 3 * The Regents of the University of California. All rights reserved. 4 * 5 * This code is derived from the Stanford/CMU enet packet filter, 6 * (net/enet.c) distributed as part of 4.3BSD, and code contributed 7 * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence 8 * Berkeley Laboratory. --- 23 unchanged lines hidden (view full) --- 32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 * 38 * @(#)bpf.h 7.1 (Berkeley) 5/7/91 39 * | 1/*- 2 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 3 * The Regents of the University of California. All rights reserved. 4 * 5 * This code is derived from the Stanford/CMU enet packet filter, 6 * (net/enet.c) distributed as part of 4.3BSD, and code contributed 7 * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence 8 * Berkeley Laboratory. --- 23 unchanged lines hidden (view full) --- 32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 * 38 * @(#)bpf.h 7.1 (Berkeley) 5/7/91 39 * |
| 40 * @(#) $Header: /tcpdump/master/libpcap/pcap-bpf.h,v 1.9.2.9 2004/03/28 21:45:32 fenner Exp $ (LBL) | 40 * @(#) $Header: /tcpdump/master/libpcap/pcap-bpf.h,v 1.34 2005/02/08 20:03:15 guy Exp $ (LBL) |
| 41 */ 42 43/* 44 * This is libpcap's cut-down version of bpf.h; it includes only 45 * the stuff needed for the code generator and the userland BPF 46 * interpreter, and the libpcap APIs for setting filters, etc.. 47 * 48 * "pcap-bpf.c" will include the native OS version, as it deals with --- 6 unchanged lines hidden (view full) --- 55 56#ifdef __cplusplus 57extern "C" { 58#endif 59 60/* BSD style release date */ 61#define BPF_RELEASE 199606 62 | 41 */ 42 43/* 44 * This is libpcap's cut-down version of bpf.h; it includes only 45 * the stuff needed for the code generator and the userland BPF 46 * interpreter, and the libpcap APIs for setting filters, etc.. 47 * 48 * "pcap-bpf.c" will include the native OS version, as it deals with --- 6 unchanged lines hidden (view full) --- 55 56#ifdef __cplusplus 57extern "C" { 58#endif 59 60/* BSD style release date */ 61#define BPF_RELEASE 199606 62 |
| 63#ifdef MSDOS /* must be 32-bit */ 64typedef long bpf_int32; 65typedef unsigned long bpf_u_int32; 66#else |
|
| 63typedef int bpf_int32; 64typedef u_int bpf_u_int32; | 67typedef int bpf_int32; 68typedef u_int bpf_u_int32; |
| 69#endif |
|
| 65 66/* 67 * Alignment macros. BPF_WORDALIGN rounds up to the next 68 * even multiple of BPF_ALIGNMENT. 69 */ 70#ifndef __NetBSD__ 71#define BPF_ALIGNMENT sizeof(bpf_int32) 72#else --- 43 unchanged lines hidden (view full) --- 116 * will ever be changed to do so (as that would destroy their ability 117 * to read captures using that value for that other purpose). 118 */ 119 120/* 121 * These are the types that are the same on all platforms, and that 122 * have been defined by <net/bpf.h> for ages. 123 */ | 70 71/* 72 * Alignment macros. BPF_WORDALIGN rounds up to the next 73 * even multiple of BPF_ALIGNMENT. 74 */ 75#ifndef __NetBSD__ 76#define BPF_ALIGNMENT sizeof(bpf_int32) 77#else --- 43 unchanged lines hidden (view full) --- 121 * will ever be changed to do so (as that would destroy their ability 122 * to read captures using that value for that other purpose). 123 */ 124 125/* 126 * These are the types that are the same on all platforms, and that 127 * have been defined by <net/bpf.h> for ages. 128 */ |
| 124#define DLT_NULL 0 /* no link-layer encapsulation */ | 129#define DLT_NULL 0 /* BSD loopback encapsulation */ |
| 125#define DLT_EN10MB 1 /* Ethernet (10Mb) */ 126#define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */ 127#define DLT_AX25 3 /* Amateur Radio AX.25 */ 128#define DLT_PRONET 4 /* Proteon ProNET Token Ring */ 129#define DLT_CHAOS 5 /* Chaos */ 130#define DLT_IEEE802 6 /* IEEE 802 Networks */ 131#define DLT_ARCNET 7 /* ARCNET, with BSD-style header */ 132#define DLT_SLIP 8 /* Serial Line IP */ --- 37 unchanged lines hidden (view full) --- 170 * 17 is used for DLT_OLD_PFLOG in OpenBSD; 171 * OBSOLETE: DLT_PFLOG is 117 in OpenBSD now as well. See below. 172 * 18 is used for DLT_PFSYNC in OpenBSD; don't use it for anything else. 173 */ 174 175#define DLT_ATM_CLIP 19 /* Linux Classical-IP over ATM */ 176 177/* | 130#define DLT_EN10MB 1 /* Ethernet (10Mb) */ 131#define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */ 132#define DLT_AX25 3 /* Amateur Radio AX.25 */ 133#define DLT_PRONET 4 /* Proteon ProNET Token Ring */ 134#define DLT_CHAOS 5 /* Chaos */ 135#define DLT_IEEE802 6 /* IEEE 802 Networks */ 136#define DLT_ARCNET 7 /* ARCNET, with BSD-style header */ 137#define DLT_SLIP 8 /* Serial Line IP */ --- 37 unchanged lines hidden (view full) --- 175 * 17 is used for DLT_OLD_PFLOG in OpenBSD; 176 * OBSOLETE: DLT_PFLOG is 117 in OpenBSD now as well. See below. 177 * 18 is used for DLT_PFSYNC in OpenBSD; don't use it for anything else. 178 */ 179 180#define DLT_ATM_CLIP 19 /* Linux Classical-IP over ATM */ 181 182/* |
| 183 * Apparently Redback uses this for its SmartEdge 400/800. I hope 184 * nobody else decided to use it, too. 185 */ 186#define DLT_REDBACK_SMARTEDGE 32 187 188/* |
|
| 178 * These values are defined by NetBSD; other platforms should refrain from 179 * using them for other purposes, so that NetBSD savefiles with link 180 * types of 50 or 51 can be read as this type on all platforms. 181 */ 182#define DLT_PPP_SERIAL 50 /* PPP over serial with HDLC encapsulation */ 183#define DLT_PPP_ETHER 51 /* PPP over Ethernet */ 184 185/* --- 159 unchanged lines hidden (view full) --- 345 * Reserved as per request from Kent Dahlgren <kent@praesum.com> 346 * for private use. 347 */ 348#define DLT_RIO 124 /* RapidIO */ 349#define DLT_PCI_EXP 125 /* PCI Express */ 350#define DLT_AURORA 126 /* Xilinx Aurora link layer */ 351 352/* | 189 * These values are defined by NetBSD; other platforms should refrain from 190 * using them for other purposes, so that NetBSD savefiles with link 191 * types of 50 or 51 can be read as this type on all platforms. 192 */ 193#define DLT_PPP_SERIAL 50 /* PPP over serial with HDLC encapsulation */ 194#define DLT_PPP_ETHER 51 /* PPP over Ethernet */ 195 196/* --- 159 unchanged lines hidden (view full) --- 356 * Reserved as per request from Kent Dahlgren <kent@praesum.com> 357 * for private use. 358 */ 359#define DLT_RIO 124 /* RapidIO */ 360#define DLT_PCI_EXP 125 /* PCI Express */ 361#define DLT_AURORA 126 /* Xilinx Aurora link layer */ 362 363/* |
| 353 * BSD header for 802.11 plus a number of bits of link-layer information 354 * including radio information. | 364 * Header for 802.11 plus a number of bits of link-layer information 365 * including radio information, used by some recent BSD drivers as 366 * well as the madwifi Atheros driver for Linux. |
| 355 */ | 367 */ |
| 356#define DLT_IEEE802_11_RADIO 127 /* 802.11 plus BSD radio header */ | 368#define DLT_IEEE802_11_RADIO 127 /* 802.11 plus radiotap radio header */ |
| 357 358/* 359 * Reserved for the TZSP encapsulation, as per request from 360 * Chris Waters <chris.waters@networkchemistry.com> 361 * TZSP is a generic encapsulation for any other link type, 362 * which includes a means to include meta-information 363 * with the packet, e.g. signal strength and channel 364 * for 802.11 packets. --- 45 unchanged lines hidden (view full) --- 410 */ 411#define DLT_APPLE_IP_OVER_IEEE1394 138 412 413/* 414 * 139 through 142 are reserved for SS7. 415 */ 416 417/* | 369 370/* 371 * Reserved for the TZSP encapsulation, as per request from 372 * Chris Waters <chris.waters@networkchemistry.com> 373 * TZSP is a generic encapsulation for any other link type, 374 * which includes a means to include meta-information 375 * with the packet, e.g. signal strength and channel 376 * for 802.11 packets. --- 45 unchanged lines hidden (view full) --- 422 */ 423#define DLT_APPLE_IP_OVER_IEEE1394 138 424 425/* 426 * 139 through 142 are reserved for SS7. 427 */ 428 429/* |
| 418 * Reserved for DOCSIS MAC frames. | 430 * DOCSIS MAC frames. |
| 419 */ 420#define DLT_DOCSIS 143 421 422/* 423 * Linux-IrDA packets. Protocol defined at http://www.irda.org. 424 * Those packets include IrLAP headers and above (IrLMP...), but 425 * don't include Phy framing (SOF/EOF/CRC & byte stuffing), because Phy 426 * framing can be handled by the hardware and depend on the bitrate. --- 59 unchanged lines hidden (view full) --- 486 487/* 488 * For future use with 802.11 captures - defined by AbsoluteValue 489 * Systems to store a number of bits of link-layer information 490 * including radio information: 491 * 492 * http://www.shaftnet.org/~pizza/software/capturefrm.txt 493 * | 431 */ 432#define DLT_DOCSIS 143 433 434/* 435 * Linux-IrDA packets. Protocol defined at http://www.irda.org. 436 * Those packets include IrLAP headers and above (IrLMP...), but 437 * don't include Phy framing (SOF/EOF/CRC & byte stuffing), because Phy 438 * framing can be handled by the hardware and depend on the bitrate. --- 59 unchanged lines hidden (view full) --- 498 499/* 500 * For future use with 802.11 captures - defined by AbsoluteValue 501 * Systems to store a number of bits of link-layer information 502 * including radio information: 503 * 504 * http://www.shaftnet.org/~pizza/software/capturefrm.txt 505 * |
| 494 * but could and arguably should also be used by non-AVS Linux 495 * 802.11 drivers; that may happen in the future. | 506 * but it might be used by some non-AVS drivers now or in the 507 * future. |
| 496 */ 497#define DLT_IEEE802_11_RADIO_AVS 163 /* 802.11 plus AVS radio header */ 498 499/* 500 * Juniper-private data link type, as per request from 501 * Hannes Gredler <hannes@juniper.net>. The DLT_s are used 502 * for passing on chassis-internal metainformation such as 503 * QOS profiles, etc.. 504 */ 505#define DLT_JUNIPER_MONITOR 164 506 507/* | 508 */ 509#define DLT_IEEE802_11_RADIO_AVS 163 /* 802.11 plus AVS radio header */ 510 511/* 512 * Juniper-private data link type, as per request from 513 * Hannes Gredler <hannes@juniper.net>. The DLT_s are used 514 * for passing on chassis-internal metainformation such as 515 * QOS profiles, etc.. 516 */ 517#define DLT_JUNIPER_MONITOR 164 518 519/* |
| 520 * Reserved for BACnet MS/TP. 521 */ 522#define DLT_BACNET_MS_TP 165 523 524/* 525 * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>. 526 * 527 * This is used in some OSes to allow a kernel socket filter to distinguish 528 * between incoming and outgoing packets, on a socket intended to 529 * supply pppd with outgoing packets so it can do dial-on-demand and 530 * hangup-on-lack-of-demand; incoming packets are filtered out so they 531 * don't cause pppd to hold the connection up (you don't want random 532 * input packets such as port scans, packets from old lost connections, 533 * etc. to force the connection to stay up). 534 * 535 * The first byte of the PPP header (0xff03) is modified to accomodate 536 * the direction - 0x00 = IN, 0x01 = OUT. 537 */ 538#define DLT_PPP_PPPD 166 539 540/* 541 * Names for backwards compatibility with older versions of some PPP 542 * software; new software should use DLT_PPP_PPPD. 543 */ 544#define DLT_PPP_WITH_DIRECTION DLT_PPP_PPPD 545#define DLT_LINUX_PPP_WITHDIRECTION DLT_PPP_PPPD 546 547/* 548 * Juniper-private data link type, as per request from 549 * Hannes Gredler <hannes@juniper.net>. The DLT_s are used 550 * for passing on chassis-internal metainformation such as 551 * QOS profiles, cookies, etc.. 552 */ 553#define DLT_JUNIPER_PPPOE 167 554#define DLT_JUNIPER_PPPOE_ATM 168 555 556#define DLT_GPRS_LLC 169 /* GPRS LLC */ 557#define DLT_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */ 558#define DLT_GPF_F 171 /* GPF-F (ITU-T G.7041/Y.1303) */ 559 560/* 561 * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line 562 * monitoring equipment. 563 */ 564#define DLT_GCOM_T1E1 172 565#define DLT_GCOM_SERIAL 173 566 567/* 568 * Juniper-private data link type, as per request from 569 * Hannes Gredler <hannes@juniper.net>. The DLT_ is used 570 * for internal communication to Physical Interface Cards (PIC) 571 */ 572#define DLT_JUNIPER_PIC_PEER 174 573 574/* 575 * Link types requested by Gregor Maier <gregor@endace.com> of Endace 576 * Measurement Systems. They add an ERF header (see 577 * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of 578 * the link-layer header. 579 */ 580#define DLT_ERF_ETH 175 /* Ethernet */ 581#define DLT_ERF_POS 176 /* Packet-over-SONET */ 582 583/* |
|
| 508 * The instruction encodings. 509 */ 510/* instruction classes */ 511#define BPF_CLASS(code) ((code) & 0x07) 512#define BPF_LD 0x00 513#define BPF_LDX 0x01 514#define BPF_ST 0x02 515#define BPF_STX 0x03 --- 81 unchanged lines hidden --- | 584 * The instruction encodings. 585 */ 586/* instruction classes */ 587#define BPF_CLASS(code) ((code) & 0x07) 588#define BPF_LD 0x00 589#define BPF_LDX 0x01 590#define BPF_ST 0x02 591#define BPF_STX 0x03 --- 81 unchanged lines hidden --- |