1/*
2 * pcap-linux.c: Packet capture interface to the Linux kernel
3 *
4 * Copyright (c) 2000 Torsten Landschoff <torsten@debian.org>
5 * Sebastian Krahmer <krahmer@cs.uni-potsdam.de>
6 *
7 * License: BSD
8 *

--- 152 unchanged lines hidden (view full) ---

161#ifdef PCAP_SUPPORT_BT
162#include "pcap-bt-linux.h"
163#endif
164
165#ifdef PCAP_SUPPORT_CAN
166#include "pcap-can-linux.h"
167#endif
168
169#ifdef PCAP_SUPPORT_NETFILTER
170#include "pcap-netfilter-linux.h"
171#endif
172
173/*
174 * If PF_PACKET is defined, we can use {SOCK_RAW,SOCK_DGRAM}/PF_PACKET
175 * sockets rather than SOCK_PACKET sockets.
176 *

--- 236 unchanged lines hidden (view full) ---

413#endif /* HAVE_SNF_API */
414
415#ifdef PCAP_SUPPORT_BT
416 if (strstr(device, "bluetooth")) {
417 return bt_create(device, ebuf);
418 }
419#endif
420
421#ifdef PCAP_SUPPORT_CAN
422 if (strstr(device, "can") || strstr(device, "vcan")) {
423 return can_create(device, ebuf);
424 }
425#endif
426
427#ifdef PCAP_SUPPORT_USB
428 if (strstr(device, "usbmon")) {
429 return usb_create(device, ebuf);
430 }

--- 1863 unchanged lines hidden (view full) ---

2294#ifdef PCAP_SUPPORT_NETFILTER
2295 /*
2296 * Add netfilter devices.
2297 */
2298 if (netfilter_platform_finddevs(alldevsp, errbuf) < 0)
2299 return (-1);
2300#endif
2301
2302 return (0);
2303}
2304
2305/*
2306 * Attach the given BPF code to the packet capture device.
2307 */
2308static int
2309pcap_setfilter_linux_common(pcap_t *handle, struct bpf_program *filter,

--- 3088 unchanged lines hidden (view full) ---

5398 if (p->k >= SLL_HDR_LEN) {
5399 /*
5400 * It's within the link-layer payload; that starts at an
5401 * offset of 0, as far as the kernel packet filter is
5402 * concerned, so subtract the length of the link-layer
5403 * header.
5404 */
5405 p->k -= SLL_HDR_LEN;
5406 } else if (p->k == 14) {
5407 /*
5408 * It's the protocol field; map it to the special magic
5409 * kernel offset for that field.
5410 */
5411 p->k = SKF_AD_OFF + SKF_AD_PROTOCOL;
5412 } else {
5413 /*
5414 * It's within the header, but it's not one of those
5415 * fields; we can't do that in the kernel, so punt
5416 * to userland.
5417 */
5418 return -1;
5419 }
5420 return 0;

--- 119 unchanged lines hidden ---