1335640Shselasky/* 2335640Shselasky * Copyright (c) 1993, 1994, 1995, 1996, 1997 3335640Shselasky * The Regents of the University of California. All rights reserved. 4335640Shselasky * 5335640Shselasky * Redistribution and use in source and binary forms, with or without 6335640Shselasky * modification, are permitted provided that: (1) source code distributions 7335640Shselasky * retain the above copyright notice and this paragraph in its entirety, (2) 8335640Shselasky * distributions including binary code include the above copyright notice and 9335640Shselasky * this paragraph in its entirety in the documentation or other materials 10335640Shselasky * provided with the distribution, and (3) all advertising materials mentioning 11335640Shselasky * features or use of this software display the following acknowledgement: 12335640Shselasky * ``This product includes software developed by the University of California, 13335640Shselasky * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14335640Shselasky * the University nor the names of its contributors may be used to endorse 15335640Shselasky * or promote products derived from this software without specific prior 16335640Shselasky * written permission. 17335640Shselasky * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18335640Shselasky * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19335640Shselasky * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20335640Shselasky * 21335640Shselasky * pcap-common.c - common code for pcap and pcapng files 22335640Shselasky */ 23335640Shselasky 24335640Shselasky#ifdef HAVE_CONFIG_H 25335640Shselasky#include <config.h> 26335640Shselasky#endif 27335640Shselasky 28335640Shselasky#include <pcap-types.h> 29335640Shselasky 30335640Shselasky#include "pcap-int.h" 31335640Shselasky#include "extract.h" 32335640Shselasky#include "pcap/sll.h" 33335640Shselasky#include "pcap/usb.h" 34335640Shselasky#include "pcap/nflog.h" 35335640Shselasky#include "pcap/can_socketcan.h" 36335640Shselasky 37335640Shselasky#include "pcap-common.h" 38335640Shselasky 39335640Shselasky/* 40335640Shselasky * We don't write DLT_* values to capture files, because they're not the 41335640Shselasky * same on all platforms. 42335640Shselasky * 43335640Shselasky * Unfortunately, the various flavors of BSD have not always used the same 44335640Shselasky * numerical values for the same data types, and various patches to 45335640Shselasky * libpcap for non-BSD OSes have added their own DLT_* codes for link 46335640Shselasky * layer encapsulation types seen on those OSes, and those codes have had, 47335640Shselasky * in some cases, values that were also used, on other platforms, for other 48335640Shselasky * link layer encapsulation types. 49335640Shselasky * 50335640Shselasky * This means that capture files of a type whose numerical DLT_* code 51335640Shselasky * means different things on different BSDs, or with different versions 52335640Shselasky * of libpcap, can't always be read on systems other than those like 53335640Shselasky * the one running on the machine on which the capture was made. 54335640Shselasky * 55335640Shselasky * Instead, we define here a set of LINKTYPE_* codes, and map DLT_* codes 56335640Shselasky * to LINKTYPE_* codes when writing a savefile header, and map LINKTYPE_* 57335640Shselasky * codes to DLT_* codes when reading a savefile header. 58335640Shselasky * 59335640Shselasky * For those DLT_* codes that have, as far as we know, the same values on 60335640Shselasky * all platforms (DLT_NULL through DLT_FDDI), we define LINKTYPE_xxx as 61335640Shselasky * DLT_xxx; that way, captures of those types can still be read by 62335640Shselasky * versions of libpcap that map LINKTYPE_* values to DLT_* values, and 63335640Shselasky * captures of those types written by versions of libpcap that map DLT_ 64335640Shselasky * values to LINKTYPE_ values can still be read by older versions 65335640Shselasky * of libpcap. 66335640Shselasky * 67335640Shselasky * The other LINKTYPE_* codes are given values starting at 100, in the 68335640Shselasky * hopes that no DLT_* code will be given one of those values. 69335640Shselasky * 70335640Shselasky * In order to ensure that a given LINKTYPE_* code's value will refer to 71335640Shselasky * the same encapsulation type on all platforms, you should not allocate 72335640Shselasky * a new LINKTYPE_* value without consulting 73335640Shselasky * "tcpdump-workers@lists.tcpdump.org". The tcpdump developers will 74335640Shselasky * allocate a value for you, and will not subsequently allocate it to 75335640Shselasky * anybody else; that value will be added to the "pcap.h" in the 76335640Shselasky * tcpdump.org Git repository, so that a future libpcap release will 77335640Shselasky * include it. 78335640Shselasky * 79335640Shselasky * You should, if possible, also contribute patches to libpcap and tcpdump 80335640Shselasky * to handle the new encapsulation type, so that they can also be checked 81335640Shselasky * into the tcpdump.org Git repository and so that they will appear in 82335640Shselasky * future libpcap and tcpdump releases. 83335640Shselasky * 84335640Shselasky * Do *NOT* assume that any values after the largest value in this file 85335640Shselasky * are available; you might not have the most up-to-date version of this 86335640Shselasky * file, and new values after that one might have been assigned. Also, 87335640Shselasky * do *NOT* use any values below 100 - those might already have been 88335640Shselasky * taken by one (or more!) organizations. 89335640Shselasky * 90335640Shselasky * Any platform that defines additional DLT_* codes should: 91335640Shselasky * 92335640Shselasky * request a LINKTYPE_* code and value from tcpdump.org, 93335640Shselasky * as per the above; 94335640Shselasky * 95335640Shselasky * add, in their version of libpcap, an entry to map 96335640Shselasky * those DLT_* codes to the corresponding LINKTYPE_* 97335640Shselasky * code; 98335640Shselasky * 99335640Shselasky * redefine, in their "net/bpf.h", any DLT_* values 100335640Shselasky * that collide with the values used by their additional 101335640Shselasky * DLT_* codes, to remove those collisions (but without 102335640Shselasky * making them collide with any of the LINKTYPE_* 103335640Shselasky * values equal to 50 or above; they should also avoid 104335640Shselasky * defining DLT_* values that collide with those 105335640Shselasky * LINKTYPE_* values, either). 106335640Shselasky */ 107335640Shselasky#define LINKTYPE_NULL DLT_NULL 108335640Shselasky#define LINKTYPE_ETHERNET DLT_EN10MB /* also for 100Mb and up */ 109335640Shselasky#define LINKTYPE_EXP_ETHERNET DLT_EN3MB /* 3Mb experimental Ethernet */ 110335640Shselasky#define LINKTYPE_AX25 DLT_AX25 111335640Shselasky#define LINKTYPE_PRONET DLT_PRONET 112335640Shselasky#define LINKTYPE_CHAOS DLT_CHAOS 113335640Shselasky#define LINKTYPE_IEEE802_5 DLT_IEEE802 /* DLT_IEEE802 is used for 802.5 Token Ring */ 114335640Shselasky#define LINKTYPE_ARCNET_BSD DLT_ARCNET /* BSD-style headers */ 115335640Shselasky#define LINKTYPE_SLIP DLT_SLIP 116335640Shselasky#define LINKTYPE_PPP DLT_PPP 117335640Shselasky#define LINKTYPE_FDDI DLT_FDDI 118335640Shselasky 119335640Shselasky/* 120335640Shselasky * LINKTYPE_PPP is for use when there might, or might not, be an RFC 1662 121335640Shselasky * PPP in HDLC-like framing header (with 0xff 0x03 before the PPP protocol 122335640Shselasky * field) at the beginning of the packet. 123335640Shselasky * 124335640Shselasky * This is for use when there is always such a header; the address field 125335640Shselasky * might be 0xff, for regular PPP, or it might be an address field for Cisco 126335640Shselasky * point-to-point with HDLC framing as per section 4.3.1 of RFC 1547 ("Cisco 127335640Shselasky * HDLC"). This is, for example, what you get with NetBSD's DLT_PPP_SERIAL. 128335640Shselasky * 129335640Shselasky * We give it the same value as NetBSD's DLT_PPP_SERIAL, in the hopes that 130335640Shselasky * nobody else will choose a DLT_ value of 50, and so that DLT_PPP_SERIAL 131335640Shselasky * captures will be written out with a link type that NetBSD's tcpdump 132335640Shselasky * can read. 133335640Shselasky */ 134335640Shselasky#define LINKTYPE_PPP_HDLC 50 /* PPP in HDLC-like framing */ 135335640Shselasky 136335640Shselasky#define LINKTYPE_PPP_ETHER 51 /* NetBSD PPP-over-Ethernet */ 137335640Shselasky 138335640Shselasky#define LINKTYPE_SYMANTEC_FIREWALL 99 /* Symantec Enterprise Firewall */ 139335640Shselasky 140335640Shselasky/* 141335640Shselasky * These correspond to DLT_s that have different values on different 142335640Shselasky * platforms; we map between these values in capture files and 143335640Shselasky * the DLT_ values as returned by pcap_datalink() and passed to 144335640Shselasky * pcap_open_dead(). 145335640Shselasky */ 146335640Shselasky#define LINKTYPE_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */ 147335640Shselasky#define LINKTYPE_RAW 101 /* raw IP */ 148335640Shselasky#define LINKTYPE_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */ 149335640Shselasky#define LINKTYPE_PPP_BSDOS 103 /* BSD/OS PPP BPF header */ 150335640Shselasky 151335640Shselasky/* 152335640Shselasky * Values starting with 104 are used for newly-assigned link-layer 153335640Shselasky * header type values; for those link-layer header types, the DLT_ 154335640Shselasky * value returned by pcap_datalink() and passed to pcap_open_dead(), 155335640Shselasky * and the LINKTYPE_ value that appears in capture files, are the 156335640Shselasky * same. 157335640Shselasky * 158335640Shselasky * LINKTYPE_MATCHING_MIN is the lowest such value; LINKTYPE_MATCHING_MAX 159335640Shselasky * is the highest such value. 160335640Shselasky */ 161335640Shselasky#define LINKTYPE_MATCHING_MIN 104 /* lowest value in the "matching" range */ 162335640Shselasky 163335640Shselasky#define LINKTYPE_C_HDLC 104 /* Cisco HDLC */ 164335640Shselasky#define LINKTYPE_IEEE802_11 105 /* IEEE 802.11 (wireless) */ 165335640Shselasky#define LINKTYPE_ATM_CLIP 106 /* Linux Classical IP over ATM */ 166335640Shselasky#define LINKTYPE_FRELAY 107 /* Frame Relay */ 167335640Shselasky#define LINKTYPE_LOOP 108 /* OpenBSD loopback */ 168335640Shselasky#define LINKTYPE_ENC 109 /* OpenBSD IPSEC enc */ 169335640Shselasky 170335640Shselasky/* 171335640Shselasky * These three types are reserved for future use. 172335640Shselasky */ 173335640Shselasky#define LINKTYPE_LANE8023 110 /* ATM LANE + 802.3 */ 174335640Shselasky#define LINKTYPE_HIPPI 111 /* NetBSD HIPPI */ 175335640Shselasky#define LINKTYPE_HDLC 112 /* NetBSD HDLC framing */ 176335640Shselasky 177335640Shselasky#define LINKTYPE_LINUX_SLL 113 /* Linux cooked socket capture */ 178335640Shselasky#define LINKTYPE_LTALK 114 /* Apple LocalTalk hardware */ 179335640Shselasky#define LINKTYPE_ECONET 115 /* Acorn Econet */ 180335640Shselasky 181335640Shselasky/* 182335640Shselasky * Reserved for use with OpenBSD ipfilter. 183335640Shselasky */ 184335640Shselasky#define LINKTYPE_IPFILTER 116 185335640Shselasky 186335640Shselasky#define LINKTYPE_PFLOG 117 /* OpenBSD DLT_PFLOG */ 187335640Shselasky#define LINKTYPE_CISCO_IOS 118 /* For Cisco-internal use */ 188335640Shselasky#define LINKTYPE_IEEE802_11_PRISM 119 /* 802.11 plus Prism II monitor mode radio metadata header */ 189335640Shselasky#define LINKTYPE_IEEE802_11_AIRONET 120 /* 802.11 plus FreeBSD Aironet driver radio metadata header */ 190335640Shselasky 191335640Shselasky/* 192335640Shselasky * Reserved for Siemens HiPath HDLC. 193335640Shselasky */ 194335640Shselasky#define LINKTYPE_HHDLC 121 195335640Shselasky 196335640Shselasky#define LINKTYPE_IP_OVER_FC 122 /* RFC 2625 IP-over-Fibre Channel */ 197335640Shselasky#define LINKTYPE_SUNATM 123 /* Solaris+SunATM */ 198335640Shselasky 199335640Shselasky/* 200335640Shselasky * Reserved as per request from Kent Dahlgren <kent@praesum.com> 201335640Shselasky * for private use. 202335640Shselasky */ 203335640Shselasky#define LINKTYPE_RIO 124 /* RapidIO */ 204335640Shselasky#define LINKTYPE_PCI_EXP 125 /* PCI Express */ 205335640Shselasky#define LINKTYPE_AURORA 126 /* Xilinx Aurora link layer */ 206335640Shselasky 207335640Shselasky#define LINKTYPE_IEEE802_11_RADIOTAP 127 /* 802.11 plus radiotap radio metadata header */ 208335640Shselasky 209335640Shselasky/* 210335640Shselasky * Reserved for the TZSP encapsulation, as per request from 211335640Shselasky * Chris Waters <chris.waters@networkchemistry.com> 212335640Shselasky * TZSP is a generic encapsulation for any other link type, 213335640Shselasky * which includes a means to include meta-information 214335640Shselasky * with the packet, e.g. signal strength and channel 215335640Shselasky * for 802.11 packets. 216335640Shselasky */ 217335640Shselasky#define LINKTYPE_TZSP 128 /* Tazmen Sniffer Protocol */ 218335640Shselasky 219335640Shselasky#define LINKTYPE_ARCNET_LINUX 129 /* Linux-style headers */ 220335640Shselasky 221335640Shselasky/* 222335640Shselasky * Juniper-private data link types, as per request from 223335640Shselasky * Hannes Gredler <hannes@juniper.net>. The corresponding 224335640Shselasky * DLT_s are used for passing on chassis-internal 225335640Shselasky * metainformation such as QOS profiles, etc.. 226335640Shselasky */ 227335640Shselasky#define LINKTYPE_JUNIPER_MLPPP 130 228335640Shselasky#define LINKTYPE_JUNIPER_MLFR 131 229335640Shselasky#define LINKTYPE_JUNIPER_ES 132 230335640Shselasky#define LINKTYPE_JUNIPER_GGSN 133 231335640Shselasky#define LINKTYPE_JUNIPER_MFR 134 232335640Shselasky#define LINKTYPE_JUNIPER_ATM2 135 233335640Shselasky#define LINKTYPE_JUNIPER_SERVICES 136 234335640Shselasky#define LINKTYPE_JUNIPER_ATM1 137 235335640Shselasky 236335640Shselasky#define LINKTYPE_APPLE_IP_OVER_IEEE1394 138 /* Apple IP-over-IEEE 1394 cooked header */ 237335640Shselasky 238335640Shselasky#define LINKTYPE_MTP2_WITH_PHDR 139 239335640Shselasky#define LINKTYPE_MTP2 140 240335640Shselasky#define LINKTYPE_MTP3 141 241335640Shselasky#define LINKTYPE_SCCP 142 242335640Shselasky 243335640Shselasky#define LINKTYPE_DOCSIS 143 /* DOCSIS MAC frames */ 244335640Shselasky 245335640Shselasky#define LINKTYPE_LINUX_IRDA 144 /* Linux-IrDA */ 246335640Shselasky 247335640Shselasky/* 248335640Shselasky * Reserved for IBM SP switch and IBM Next Federation switch. 249335640Shselasky */ 250335640Shselasky#define LINKTYPE_IBM_SP 145 251335640Shselasky#define LINKTYPE_IBM_SN 146 252335640Shselasky 253335640Shselasky/* 254335640Shselasky * Reserved for private use. If you have some link-layer header type 255335640Shselasky * that you want to use within your organization, with the capture files 256335640Shselasky * using that link-layer header type not ever be sent outside your 257335640Shselasky * organization, you can use these values. 258335640Shselasky * 259335640Shselasky * No libpcap release will use these for any purpose, nor will any 260335640Shselasky * tcpdump release use them, either. 261335640Shselasky * 262335640Shselasky * Do *NOT* use these in capture files that you expect anybody not using 263335640Shselasky * your private versions of capture-file-reading tools to read; in 264335640Shselasky * particular, do *NOT* use them in products, otherwise you may find that 265335640Shselasky * people won't be able to use tcpdump, or snort, or Ethereal, or... to 266335640Shselasky * read capture files from your firewall/intrusion detection/traffic 267335640Shselasky * monitoring/etc. appliance, or whatever product uses that LINKTYPE_ value, 268335640Shselasky * and you may also find that the developers of those applications will 269335640Shselasky * not accept patches to let them read those files. 270335640Shselasky * 271335640Shselasky * Also, do not use them if somebody might send you a capture using them 272335640Shselasky * for *their* private type and tools using them for *your* private type 273335640Shselasky * would have to read them. 274335640Shselasky * 275335640Shselasky * Instead, in those cases, ask "tcpdump-workers@lists.tcpdump.org" for a 276335640Shselasky * new DLT_ and LINKTYPE_ value, as per the comment in pcap/bpf.h, and use 277335640Shselasky * the type you're given. 278335640Shselasky */ 279335640Shselasky#define LINKTYPE_USER0 147 280335640Shselasky#define LINKTYPE_USER1 148 281335640Shselasky#define LINKTYPE_USER2 149 282335640Shselasky#define LINKTYPE_USER3 150 283335640Shselasky#define LINKTYPE_USER4 151 284335640Shselasky#define LINKTYPE_USER5 152 285335640Shselasky#define LINKTYPE_USER6 153 286335640Shselasky#define LINKTYPE_USER7 154 287335640Shselasky#define LINKTYPE_USER8 155 288335640Shselasky#define LINKTYPE_USER9 156 289335640Shselasky#define LINKTYPE_USER10 157 290335640Shselasky#define LINKTYPE_USER11 158 291335640Shselasky#define LINKTYPE_USER12 159 292335640Shselasky#define LINKTYPE_USER13 160 293335640Shselasky#define LINKTYPE_USER14 161 294335640Shselasky#define LINKTYPE_USER15 162 295335640Shselasky 296335640Shselasky/* 297335640Shselasky * For future use with 802.11 captures - defined by AbsoluteValue 298335640Shselasky * Systems to store a number of bits of link-layer information 299335640Shselasky * including radio information: 300335640Shselasky * 301335640Shselasky * http://www.shaftnet.org/~pizza/software/capturefrm.txt 302335640Shselasky */ 303335640Shselasky#define LINKTYPE_IEEE802_11_AVS 163 /* 802.11 plus AVS radio metadata header */ 304335640Shselasky 305335640Shselasky/* 306335640Shselasky * Juniper-private data link type, as per request from 307335640Shselasky * Hannes Gredler <hannes@juniper.net>. The corresponding 308335640Shselasky * DLT_s are used for passing on chassis-internal 309335640Shselasky * metainformation such as QOS profiles, etc.. 310335640Shselasky */ 311335640Shselasky#define LINKTYPE_JUNIPER_MONITOR 164 312335640Shselasky 313335640Shselasky/* 314335640Shselasky * BACnet MS/TP frames. 315335640Shselasky */ 316335640Shselasky#define LINKTYPE_BACNET_MS_TP 165 317335640Shselasky 318335640Shselasky/* 319335640Shselasky * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>. 320335640Shselasky * 321335640Shselasky * This is used in some OSes to allow a kernel socket filter to distinguish 322335640Shselasky * between incoming and outgoing packets, on a socket intended to 323335640Shselasky * supply pppd with outgoing packets so it can do dial-on-demand and 324335640Shselasky * hangup-on-lack-of-demand; incoming packets are filtered out so they 325335640Shselasky * don't cause pppd to hold the connection up (you don't want random 326335640Shselasky * input packets such as port scans, packets from old lost connections, 327335640Shselasky * etc. to force the connection to stay up). 328335640Shselasky * 329335640Shselasky * The first byte of the PPP header (0xff03) is modified to accomodate 330335640Shselasky * the direction - 0x00 = IN, 0x01 = OUT. 331335640Shselasky */ 332335640Shselasky#define LINKTYPE_PPP_PPPD 166 333335640Shselasky 334335640Shselasky/* 335335640Shselasky * Juniper-private data link type, as per request from 336335640Shselasky * Hannes Gredler <hannes@juniper.net>. The DLT_s are used 337335640Shselasky * for passing on chassis-internal metainformation such as 338335640Shselasky * QOS profiles, cookies, etc.. 339335640Shselasky */ 340335640Shselasky#define LINKTYPE_JUNIPER_PPPOE 167 341335640Shselasky#define LINKTYPE_JUNIPER_PPPOE_ATM 168 342335640Shselasky 343335640Shselasky#define LINKTYPE_GPRS_LLC 169 /* GPRS LLC */ 344335640Shselasky#define LINKTYPE_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */ 345335640Shselasky#define LINKTYPE_GPF_F 171 /* GPF-F (ITU-T G.7041/Y.1303) */ 346335640Shselasky 347335640Shselasky/* 348335640Shselasky * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line 349335640Shselasky * monitoring equipment. 350335640Shselasky */ 351335640Shselasky#define LINKTYPE_GCOM_T1E1 172 352335640Shselasky#define LINKTYPE_GCOM_SERIAL 173 353335640Shselasky 354335640Shselasky/* 355335640Shselasky * Juniper-private data link type, as per request from 356335640Shselasky * Hannes Gredler <hannes@juniper.net>. The DLT_ is used 357335640Shselasky * for internal communication to Physical Interface Cards (PIC) 358335640Shselasky */ 359335640Shselasky#define LINKTYPE_JUNIPER_PIC_PEER 174 360335640Shselasky 361335640Shselasky/* 362335640Shselasky * Link types requested by Gregor Maier <gregor@endace.com> of Endace 363335640Shselasky * Measurement Systems. They add an ERF header (see 364335640Shselasky * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of 365335640Shselasky * the link-layer header. 366335640Shselasky */ 367335640Shselasky#define LINKTYPE_ERF_ETH 175 /* Ethernet */ 368335640Shselasky#define LINKTYPE_ERF_POS 176 /* Packet-over-SONET */ 369335640Shselasky 370335640Shselasky/* 371335640Shselasky * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD 372335640Shselasky * for vISDN (http://www.orlandi.com/visdn/). Its link-layer header 373335640Shselasky * includes additional information before the LAPD header, so it's 374335640Shselasky * not necessarily a generic LAPD header. 375335640Shselasky */ 376335640Shselasky#define LINKTYPE_LINUX_LAPD 177 377335640Shselasky 378335640Shselasky/* 379335640Shselasky * Juniper-private data link type, as per request from 380335640Shselasky * Hannes Gredler <hannes@juniper.net>. 381335640Shselasky * The Link Types are used for prepending meta-information 382335640Shselasky * like interface index, interface name 383335640Shselasky * before standard Ethernet, PPP, Frelay & C-HDLC Frames 384335640Shselasky */ 385335640Shselasky#define LINKTYPE_JUNIPER_ETHER 178 386335640Shselasky#define LINKTYPE_JUNIPER_PPP 179 387335640Shselasky#define LINKTYPE_JUNIPER_FRELAY 180 388335640Shselasky#define LINKTYPE_JUNIPER_CHDLC 181 389335640Shselasky 390335640Shselasky/* 391335640Shselasky * Multi Link Frame Relay (FRF.16) 392335640Shselasky */ 393335640Shselasky#define LINKTYPE_MFR 182 394335640Shselasky 395335640Shselasky/* 396335640Shselasky * Juniper-private data link type, as per request from 397335640Shselasky * Hannes Gredler <hannes@juniper.net>. 398335640Shselasky * The DLT_ is used for internal communication with a 399335640Shselasky * voice Adapter Card (PIC) 400335640Shselasky */ 401335640Shselasky#define LINKTYPE_JUNIPER_VP 183 402335640Shselasky 403335640Shselasky/* 404335640Shselasky * Arinc 429 frames. 405335640Shselasky * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 406335640Shselasky * Every frame contains a 32bit A429 label. 407335640Shselasky * More documentation on Arinc 429 can be found at 408335640Shselasky * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf 409335640Shselasky */ 410335640Shselasky#define LINKTYPE_A429 184 411335640Shselasky 412335640Shselasky/* 413335640Shselasky * Arinc 653 Interpartition Communication messages. 414335640Shselasky * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 415335640Shselasky * Please refer to the A653-1 standard for more information. 416335640Shselasky */ 417335640Shselasky#define LINKTYPE_A653_ICM 185 418335640Shselasky 419335640Shselasky/* 420335640Shselasky * This used to be "USB packets, beginning with a USB setup header; 421335640Shselasky * requested by Paolo Abeni <paolo.abeni@email.it>." 422335640Shselasky * 423335640Shselasky * However, that header didn't work all that well - it left out some 424335640Shselasky * useful information - and was abandoned in favor of the DLT_USB_LINUX 425335640Shselasky * header. 426335640Shselasky * 427335640Shselasky * This is now used by FreeBSD for its BPF taps for USB; that has its 428335640Shselasky * own headers. So it is written, so it is done. 429335640Shselasky */ 430335640Shselasky#define LINKTYPE_USB_FREEBSD 186 431335640Shselasky 432335640Shselasky/* 433335640Shselasky * Bluetooth HCI UART transport layer (part H:4); requested by 434335640Shselasky * Paolo Abeni. 435335640Shselasky */ 436335640Shselasky#define LINKTYPE_BLUETOOTH_HCI_H4 187 437335640Shselasky 438335640Shselasky/* 439335640Shselasky * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz 440335640Shselasky * <cruz_petagay@bah.com>. 441335640Shselasky */ 442335640Shselasky#define LINKTYPE_IEEE802_16_MAC_CPS 188 443335640Shselasky 444335640Shselasky/* 445335640Shselasky * USB packets, beginning with a Linux USB header; requested by 446335640Shselasky * Paolo Abeni <paolo.abeni@email.it>. 447335640Shselasky */ 448335640Shselasky#define LINKTYPE_USB_LINUX 189 449335640Shselasky 450335640Shselasky/* 451335640Shselasky * Controller Area Network (CAN) v. 2.0B packets. 452335640Shselasky * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 453335640Shselasky * Used to dump CAN packets coming from a CAN Vector board. 454335640Shselasky * More documentation on the CAN v2.0B frames can be found at 455335640Shselasky * http://www.can-cia.org/downloads/?269 456335640Shselasky */ 457335640Shselasky#define LINKTYPE_CAN20B 190 458335640Shselasky 459335640Shselasky/* 460335640Shselasky * IEEE 802.15.4, with address fields padded, as is done by Linux 461335640Shselasky * drivers; requested by Juergen Schimmer. 462335640Shselasky */ 463335640Shselasky#define LINKTYPE_IEEE802_15_4_LINUX 191 464335640Shselasky 465335640Shselasky/* 466335640Shselasky * Per Packet Information encapsulated packets. 467335640Shselasky * LINKTYPE_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 468335640Shselasky */ 469335640Shselasky#define LINKTYPE_PPI 192 470335640Shselasky 471335640Shselasky/* 472335640Shselasky * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header; 473335640Shselasky * requested by Charles Clancy. 474335640Shselasky */ 475335640Shselasky#define LINKTYPE_IEEE802_16_MAC_CPS_RADIO 193 476335640Shselasky 477335640Shselasky/* 478335640Shselasky * Juniper-private data link type, as per request from 479335640Shselasky * Hannes Gredler <hannes@juniper.net>. 480335640Shselasky * The DLT_ is used for internal communication with a 481335640Shselasky * integrated service module (ISM). 482335640Shselasky */ 483335640Shselasky#define LINKTYPE_JUNIPER_ISM 194 484335640Shselasky 485335640Shselasky/* 486335640Shselasky * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 487335640Shselasky * nothing), and with the FCS at the end of the frame; requested by 488335640Shselasky * Mikko Saarnivala <mikko.saarnivala@sensinode.com>. 489335640Shselasky * 490335640Shselasky * This should only be used if the FCS is present at the end of the 491335640Shselasky * frame; if the frame has no FCS, DLT_IEEE802_15_4_NOFCS should be 492335640Shselasky * used. 493335640Shselasky */ 494335640Shselasky#define LINKTYPE_IEEE802_15_4_WITHFCS 195 495335640Shselasky 496335640Shselasky/* 497335640Shselasky * Various link-layer types, with a pseudo-header, for SITA 498335640Shselasky * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com). 499335640Shselasky */ 500335640Shselasky#define LINKTYPE_SITA 196 501335640Shselasky 502335640Shselasky/* 503335640Shselasky * Various link-layer types, with a pseudo-header, for Endace DAG cards; 504335640Shselasky * encapsulates Endace ERF records. Requested by Stephen Donnelly 505335640Shselasky * <stephen@endace.com>. 506335640Shselasky */ 507335640Shselasky#define LINKTYPE_ERF 197 508335640Shselasky 509335640Shselasky/* 510335640Shselasky * Special header prepended to Ethernet packets when capturing from a 511335640Shselasky * u10 Networks board. Requested by Phil Mulholland 512335640Shselasky * <phil@u10networks.com>. 513335640Shselasky */ 514335640Shselasky#define LINKTYPE_RAIF1 198 515335640Shselasky 516335640Shselasky/* 517356341Scy * IPMB packet for IPMI, beginning with a 2-byte header, followed by 518356341Scy * the I2C slave address, followed by the netFn and LUN, etc.. 519356341Scy * Requested by Chanthy Toeung <chanthy.toeung@ca.kontron.com>. 520356341Scy * 521356341Scy * XXX - its DLT_ value used to be called DLT_IPMB, back when we got the 522356341Scy * impression from the email thread requesting it that the packet 523356341Scy * had no extra 2-byte header. We've renamed it; if anybody used 524356341Scy * DLT_IPMB and assumed no 2-byte header, this will cause the compile 525356341Scy * to fail, at which point we'll have to figure out what to do about 526356341Scy * the two header types using the same DLT_/LINKTYPE_ value. If that 527356341Scy * doesn't happen, we'll assume nobody used it and that the redefinition 528356341Scy * is safe. 529335640Shselasky */ 530356341Scy#define LINKTYPE_IPMB_KONTRON 199 531335640Shselasky 532335640Shselasky/* 533335640Shselasky * Juniper-private data link type, as per request from 534335640Shselasky * Hannes Gredler <hannes@juniper.net>. 535335640Shselasky * The DLT_ is used for capturing data on a secure tunnel interface. 536335640Shselasky */ 537335640Shselasky#define LINKTYPE_JUNIPER_ST 200 538335640Shselasky 539335640Shselasky/* 540335640Shselasky * Bluetooth HCI UART transport layer (part H:4), with pseudo-header 541335640Shselasky * that includes direction information; requested by Paolo Abeni. 542335640Shselasky */ 543335640Shselasky#define LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR 201 544335640Shselasky 545335640Shselasky/* 546335640Shselasky * AX.25 packet with a 1-byte KISS header; see 547335640Shselasky * 548335640Shselasky * http://www.ax25.net/kiss.htm 549335640Shselasky * 550335640Shselasky * as per Richard Stearn <richard@rns-stearn.demon.co.uk>. 551335640Shselasky */ 552335640Shselasky#define LINKTYPE_AX25_KISS 202 553335640Shselasky 554335640Shselasky/* 555335640Shselasky * LAPD packets from an ISDN channel, starting with the address field, 556335640Shselasky * with no pseudo-header. 557335640Shselasky * Requested by Varuna De Silva <varunax@gmail.com>. 558335640Shselasky */ 559335640Shselasky#define LINKTYPE_LAPD 203 560335640Shselasky 561356341Scy 562335640Shselasky/* 563356341Scy * PPP, with a one-byte direction pseudo-header prepended - zero means 564356341Scy * "received by this host", non-zero (any non-zero value) means "sent by 565356341Scy * this host" - as per Will Barker <w.barker@zen.co.uk>. 566335640Shselasky */ 567356341Scy#define LINKTYPE_PPP_WITH_DIR 204 /* Don't confuse with LINKTYPE_PPP_PPPD */ 568356341Scy 569356341Scy/* 570356341Scy * Cisco HDLC, with a one-byte direction pseudo-header prepended - zero 571356341Scy * means "received by this host", non-zero (any non-zero value) means 572356341Scy * "sent by this host" - as per Will Barker <w.barker@zen.co.uk>. 573356341Scy */ 574335640Shselasky#define LINKTYPE_C_HDLC_WITH_DIR 205 /* Cisco HDLC */ 575356341Scy 576356341Scy/* 577356341Scy * Frame Relay, with a one-byte direction pseudo-header prepended - zero 578356341Scy * means "received by this host" (DCE -> DTE), non-zero (any non-zero 579356341Scy * value) means "sent by this host" (DTE -> DCE) - as per Will Barker 580356341Scy * <w.barker@zen.co.uk>. 581356341Scy */ 582335640Shselasky#define LINKTYPE_FRELAY_WITH_DIR 206 /* Frame Relay */ 583356341Scy 584356341Scy/* 585356341Scy * LAPB, with a one-byte direction pseudo-header prepended - zero means 586356341Scy * "received by this host" (DCE -> DTE), non-zero (any non-zero value) 587356341Scy * means "sent by this host" (DTE -> DCE)- as per Will Barker 588356341Scy * <w.barker@zen.co.uk>. 589356341Scy */ 590335640Shselasky#define LINKTYPE_LAPB_WITH_DIR 207 /* LAPB */ 591335640Shselasky 592335640Shselasky/* 593335640Shselasky * 208 is reserved for an as-yet-unspecified proprietary link-layer 594335640Shselasky * type, as requested by Will Barker. 595335640Shselasky */ 596335640Shselasky 597335640Shselasky/* 598335640Shselasky * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman 599335640Shselasky * <avn@pigeonpoint.com>. 600335640Shselasky */ 601335640Shselasky#define LINKTYPE_IPMB_LINUX 209 602335640Shselasky 603335640Shselasky/* 604335640Shselasky * FlexRay automotive bus - http://www.flexray.com/ - as requested 605335640Shselasky * by Hannes Kaelber <hannes.kaelber@x2e.de>. 606335640Shselasky */ 607335640Shselasky#define LINKTYPE_FLEXRAY 210 608335640Shselasky 609335640Shselasky/* 610335640Shselasky * Media Oriented Systems Transport (MOST) bus for multimedia 611335640Shselasky * transport - http://www.mostcooperation.com/ - as requested 612335640Shselasky * by Hannes Kaelber <hannes.kaelber@x2e.de>. 613335640Shselasky */ 614335640Shselasky#define LINKTYPE_MOST 211 615335640Shselasky 616335640Shselasky/* 617335640Shselasky * Local Interconnect Network (LIN) bus for vehicle networks - 618335640Shselasky * http://www.lin-subbus.org/ - as requested by Hannes Kaelber 619335640Shselasky * <hannes.kaelber@x2e.de>. 620335640Shselasky */ 621335640Shselasky#define LINKTYPE_LIN 212 622335640Shselasky 623335640Shselasky/* 624335640Shselasky * X2E-private data link type used for serial line capture, 625335640Shselasky * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>. 626335640Shselasky */ 627335640Shselasky#define LINKTYPE_X2E_SERIAL 213 628335640Shselasky 629335640Shselasky/* 630335640Shselasky * X2E-private data link type used for the Xoraya data logger 631335640Shselasky * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>. 632335640Shselasky */ 633335640Shselasky#define LINKTYPE_X2E_XORAYA 214 634335640Shselasky 635335640Shselasky/* 636335640Shselasky * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 637335640Shselasky * nothing), but with the PHY-level data for non-ASK PHYs (4 octets 638335640Shselasky * of 0 as preamble, one octet of SFD, one octet of frame length+ 639335640Shselasky * reserved bit, and then the MAC-layer data, starting with the 640335640Shselasky * frame control field). 641335640Shselasky * 642335640Shselasky * Requested by Max Filippov <jcmvbkbc@gmail.com>. 643335640Shselasky */ 644335640Shselasky#define LINKTYPE_IEEE802_15_4_NONASK_PHY 215 645335640Shselasky 646335640Shselasky/* 647335640Shselasky * David Gibson <david@gibson.dropbear.id.au> requested this for 648335640Shselasky * captures from the Linux kernel /dev/input/eventN devices. This 649335640Shselasky * is used to communicate keystrokes and mouse movements from the 650335640Shselasky * Linux kernel to display systems, such as Xorg. 651335640Shselasky */ 652335640Shselasky#define LINKTYPE_LINUX_EVDEV 216 653335640Shselasky 654335640Shselasky/* 655335640Shselasky * GSM Um and Abis interfaces, preceded by a "gsmtap" header. 656335640Shselasky * 657335640Shselasky * Requested by Harald Welte <laforge@gnumonks.org>. 658335640Shselasky */ 659335640Shselasky#define LINKTYPE_GSMTAP_UM 217 660335640Shselasky#define LINKTYPE_GSMTAP_ABIS 218 661335640Shselasky 662335640Shselasky/* 663335640Shselasky * MPLS, with an MPLS label as the link-layer header. 664335640Shselasky * Requested by Michele Marchetto <michele@openbsd.org> on behalf 665335640Shselasky * of OpenBSD. 666335640Shselasky */ 667335640Shselasky#define LINKTYPE_MPLS 219 668335640Shselasky 669335640Shselasky/* 670335640Shselasky * USB packets, beginning with a Linux USB header, with the USB header 671335640Shselasky * padded to 64 bytes; required for memory-mapped access. 672335640Shselasky */ 673335640Shselasky#define LINKTYPE_USB_LINUX_MMAPPED 220 674335640Shselasky 675335640Shselasky/* 676335640Shselasky * DECT packets, with a pseudo-header; requested by 677335640Shselasky * Matthias Wenzel <tcpdump@mazzoo.de>. 678335640Shselasky */ 679335640Shselasky#define LINKTYPE_DECT 221 680335640Shselasky 681335640Shselasky/* 682335640Shselasky * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov> 683335640Shselasky * Date: Mon, 11 May 2009 11:18:30 -0500 684335640Shselasky * 685335640Shselasky * DLT_AOS. We need it for AOS Space Data Link Protocol. 686335640Shselasky * I have already written dissectors for but need an OK from 687335640Shselasky * legal before I can submit a patch. 688335640Shselasky * 689335640Shselasky */ 690335640Shselasky#define LINKTYPE_AOS 222 691335640Shselasky 692335640Shselasky/* 693335640Shselasky * Wireless HART (Highway Addressable Remote Transducer) 694335640Shselasky * From the HART Communication Foundation 695335640Shselasky * IES/PAS 62591 696335640Shselasky * 697335640Shselasky * Requested by Sam Roberts <vieuxtech@gmail.com>. 698335640Shselasky */ 699335640Shselasky#define LINKTYPE_WIHART 223 700335640Shselasky 701335640Shselasky/* 702335640Shselasky * Fibre Channel FC-2 frames, beginning with a Frame_Header. 703335640Shselasky * Requested by Kahou Lei <kahou82@gmail.com>. 704335640Shselasky */ 705335640Shselasky#define LINKTYPE_FC_2 224 706335640Shselasky 707335640Shselasky/* 708335640Shselasky * Fibre Channel FC-2 frames, beginning with an encoding of the 709335640Shselasky * SOF, and ending with an encoding of the EOF. 710335640Shselasky * 711335640Shselasky * The encodings represent the frame delimiters as 4-byte sequences 712335640Shselasky * representing the corresponding ordered sets, with K28.5 713335640Shselasky * represented as 0xBC, and the D symbols as the corresponding 714335640Shselasky * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2, 715335640Shselasky * is represented as 0xBC 0xB5 0x55 0x55. 716335640Shselasky * 717335640Shselasky * Requested by Kahou Lei <kahou82@gmail.com>. 718335640Shselasky */ 719335640Shselasky#define LINKTYPE_FC_2_WITH_FRAME_DELIMS 225 720335640Shselasky 721335640Shselasky/* 722335640Shselasky * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>. 723335640Shselasky * 724335640Shselasky * The pseudo-header starts with a one-byte version number; for version 2, 725335640Shselasky * the pseudo-header is: 726335640Shselasky * 727335640Shselasky * struct dl_ipnetinfo { 728335640Shselasky * uint8_t dli_version; 729335640Shselasky * uint8_t dli_family; 730335640Shselasky * uint16_t dli_htype; 731335640Shselasky * uint32_t dli_pktlen; 732335640Shselasky * uint32_t dli_ifindex; 733335640Shselasky * uint32_t dli_grifindex; 734335640Shselasky * uint32_t dli_zsrc; 735335640Shselasky * uint32_t dli_zdst; 736335640Shselasky * }; 737335640Shselasky * 738335640Shselasky * dli_version is 2 for the current version of the pseudo-header. 739335640Shselasky * 740335640Shselasky * dli_family is a Solaris address family value, so it's 2 for IPv4 741335640Shselasky * and 26 for IPv6. 742335640Shselasky * 743335640Shselasky * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing 744335640Shselasky * packets, and 2 for packets arriving from another zone on the same 745335640Shselasky * machine. 746335640Shselasky * 747335640Shselasky * dli_pktlen is the length of the packet data following the pseudo-header 748335640Shselasky * (so the captured length minus dli_pktlen is the length of the 749335640Shselasky * pseudo-header, assuming the entire pseudo-header was captured). 750335640Shselasky * 751335640Shselasky * dli_ifindex is the interface index of the interface on which the 752335640Shselasky * packet arrived. 753335640Shselasky * 754335640Shselasky * dli_grifindex is the group interface index number (for IPMP interfaces). 755335640Shselasky * 756335640Shselasky * dli_zsrc is the zone identifier for the source of the packet. 757335640Shselasky * 758335640Shselasky * dli_zdst is the zone identifier for the destination of the packet. 759335640Shselasky * 760335640Shselasky * A zone number of 0 is the global zone; a zone number of 0xffffffff 761335640Shselasky * means that the packet arrived from another host on the network, not 762335640Shselasky * from another zone on the same machine. 763335640Shselasky * 764335640Shselasky * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates 765335640Shselasky * which of those it is. 766335640Shselasky */ 767335640Shselasky#define LINKTYPE_IPNET 226 768335640Shselasky 769335640Shselasky/* 770335640Shselasky * CAN (Controller Area Network) frames, with a pseudo-header as supplied 771335640Shselasky * by Linux SocketCAN, and with multi-byte numerical fields in that header 772335640Shselasky * in big-endian byte order. 773335640Shselasky * 774335640Shselasky * See Documentation/networking/can.txt in the Linux source. 775335640Shselasky * 776335640Shselasky * Requested by Felix Obenhuber <felix@obenhuber.de>. 777335640Shselasky */ 778335640Shselasky#define LINKTYPE_CAN_SOCKETCAN 227 779335640Shselasky 780335640Shselasky/* 781335640Shselasky * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies 782335640Shselasky * whether it's v4 or v6. Requested by Darren Reed <Darren.Reed@Sun.COM>. 783335640Shselasky */ 784335640Shselasky#define LINKTYPE_IPV4 228 785335640Shselasky#define LINKTYPE_IPV6 229 786335640Shselasky 787335640Shselasky/* 788335640Shselasky * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 789335640Shselasky * nothing), and with no FCS at the end of the frame; requested by 790335640Shselasky * Jon Smirl <jonsmirl@gmail.com>. 791335640Shselasky */ 792335640Shselasky#define LINKTYPE_IEEE802_15_4_NOFCS 230 793335640Shselasky 794335640Shselasky/* 795335640Shselasky * Raw D-Bus: 796335640Shselasky * 797335640Shselasky * http://www.freedesktop.org/wiki/Software/dbus 798335640Shselasky * 799335640Shselasky * messages: 800335640Shselasky * 801335640Shselasky * http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages 802335640Shselasky * 803335640Shselasky * starting with the endianness flag, followed by the message type, etc., 804335640Shselasky * but without the authentication handshake before the message sequence: 805335640Shselasky * 806335640Shselasky * http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol 807335640Shselasky * 808335640Shselasky * Requested by Martin Vidner <martin@vidner.net>. 809335640Shselasky */ 810335640Shselasky#define LINKTYPE_DBUS 231 811335640Shselasky 812335640Shselasky/* 813335640Shselasky * Juniper-private data link type, as per request from 814335640Shselasky * Hannes Gredler <hannes@juniper.net>. 815335640Shselasky */ 816335640Shselasky#define LINKTYPE_JUNIPER_VS 232 817335640Shselasky#define LINKTYPE_JUNIPER_SRX_E2E 233 818335640Shselasky#define LINKTYPE_JUNIPER_FIBRECHANNEL 234 819335640Shselasky 820335640Shselasky/* 821335640Shselasky * DVB-CI (DVB Common Interface for communication between a PC Card 822335640Shselasky * module and a DVB receiver). See 823335640Shselasky * 824335640Shselasky * http://www.kaiser.cx/pcap-dvbci.html 825335640Shselasky * 826335640Shselasky * for the specification. 827335640Shselasky * 828335640Shselasky * Requested by Martin Kaiser <martin@kaiser.cx>. 829335640Shselasky */ 830335640Shselasky#define LINKTYPE_DVB_CI 235 831335640Shselasky 832335640Shselasky/* 833335640Shselasky * Variant of 3GPP TS 27.010 multiplexing protocol. Requested 834335640Shselasky * by Hans-Christoph Schemmel <hans-christoph.schemmel@cinterion.com>. 835335640Shselasky */ 836335640Shselasky#define LINKTYPE_MUX27010 236 837335640Shselasky 838335640Shselasky/* 839335640Shselasky * STANAG 5066 D_PDUs. Requested by M. Baris Demiray 840335640Shselasky * <barisdemiray@gmail.com>. 841335640Shselasky */ 842335640Shselasky#define LINKTYPE_STANAG_5066_D_PDU 237 843335640Shselasky 844335640Shselasky/* 845335640Shselasky * Juniper-private data link type, as per request from 846335640Shselasky * Hannes Gredler <hannes@juniper.net>. 847335640Shselasky */ 848335640Shselasky#define LINKTYPE_JUNIPER_ATM_CEMIC 238 849335640Shselasky 850335640Shselasky/* 851335640Shselasky * NetFilter LOG messages 852335640Shselasky * (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets) 853335640Shselasky * 854335640Shselasky * Requested by Jakub Zawadzki <darkjames-ws@darkjames.pl> 855335640Shselasky */ 856335640Shselasky#define LINKTYPE_NFLOG 239 857335640Shselasky 858335640Shselasky/* 859335640Shselasky * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type 860335640Shselasky * for Ethernet packets with a 4-byte pseudo-header and always 861335640Shselasky * with the payload including the FCS, as supplied by their 862335640Shselasky * netANALYZER hardware and software. 863335640Shselasky * 864335640Shselasky * Requested by Holger P. Frommer <HPfrommer@hilscher.com> 865335640Shselasky */ 866335640Shselasky#define LINKTYPE_NETANALYZER 240 867335640Shselasky 868335640Shselasky/* 869335640Shselasky * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type 870335640Shselasky * for Ethernet packets with a 4-byte pseudo-header and FCS and 871335640Shselasky * 1 byte of SFD, as supplied by their netANALYZER hardware and 872335640Shselasky * software. 873335640Shselasky * 874335640Shselasky * Requested by Holger P. Frommer <HPfrommer@hilscher.com> 875335640Shselasky */ 876335640Shselasky#define LINKTYPE_NETANALYZER_TRANSPARENT 241 877335640Shselasky 878335640Shselasky/* 879335640Shselasky * IP-over-InfiniBand, as specified by RFC 4391. 880335640Shselasky * 881335640Shselasky * Requested by Petr Sumbera <petr.sumbera@oracle.com>. 882335640Shselasky */ 883335640Shselasky#define LINKTYPE_IPOIB 242 884335640Shselasky 885335640Shselasky/* 886335640Shselasky * MPEG-2 transport stream (ISO 13818-1/ITU-T H.222.0). 887335640Shselasky * 888335640Shselasky * Requested by Guy Martin <gmsoft@tuxicoman.be>. 889335640Shselasky */ 890335640Shselasky#define LINKTYPE_MPEG_2_TS 243 891335640Shselasky 892335640Shselasky/* 893335640Shselasky * ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as 894335640Shselasky * used by their ng40 protocol tester. 895335640Shselasky * 896335640Shselasky * Requested by Jens Grimmer <jens.grimmer@ng4t.com>. 897335640Shselasky */ 898335640Shselasky#define LINKTYPE_NG40 244 899335640Shselasky 900335640Shselasky/* 901335640Shselasky * Pseudo-header giving adapter number and flags, followed by an NFC 902335640Shselasky * (Near-Field Communications) Logical Link Control Protocol (LLCP) PDU, 903335640Shselasky * as specified by NFC Forum Logical Link Control Protocol Technical 904335640Shselasky * Specification LLCP 1.1. 905335640Shselasky * 906335640Shselasky * Requested by Mike Wakerly <mikey@google.com>. 907335640Shselasky */ 908335640Shselasky#define LINKTYPE_NFC_LLCP 245 909335640Shselasky 910335640Shselasky/* 911335640Shselasky * pfsync output; DLT_PFSYNC is 18, which collides with DLT_CIP in 912335640Shselasky * SuSE 6.3, on OpenBSD, NetBSD, DragonFly BSD, and macOS, and 913335640Shselasky * is 121, which collides with DLT_HHDLC, in FreeBSD. We pick a 914335640Shselasky * shiny new link-layer header type value that doesn't collide with 915335640Shselasky * anything, in the hopes that future pfsync savefiles, if any, 916335640Shselasky * won't require special hacks to distinguish from other savefiles. 917335640Shselasky * 918335640Shselasky */ 919335640Shselasky#define LINKTYPE_PFSYNC 246 920335640Shselasky 921335640Shselasky/* 922335640Shselasky * Raw InfiniBand packets, starting with the Local Routing Header. 923335640Shselasky * 924335640Shselasky * Requested by Oren Kladnitsky <orenk@mellanox.com>. 925335640Shselasky */ 926335640Shselasky#define LINKTYPE_INFINIBAND 247 927335640Shselasky 928335640Shselasky/* 929335640Shselasky * SCTP, with no lower-level protocols (i.e., no IPv4 or IPv6). 930335640Shselasky * 931335640Shselasky * Requested by Michael Tuexen <Michael.Tuexen@lurchi.franken.de>. 932335640Shselasky */ 933335640Shselasky#define LINKTYPE_SCTP 248 934335640Shselasky 935335640Shselasky/* 936335640Shselasky * USB packets, beginning with a USBPcap header. 937335640Shselasky * 938335640Shselasky * Requested by Tomasz Mon <desowin@gmail.com> 939335640Shselasky */ 940335640Shselasky#define LINKTYPE_USBPCAP 249 941335640Shselasky 942335640Shselasky/* 943335640Shselasky * Schweitzer Engineering Laboratories "RTAC" product serial-line 944335640Shselasky * packets. 945335640Shselasky * 946335640Shselasky * Requested by Chris Bontje <chris_bontje@selinc.com>. 947335640Shselasky */ 948335640Shselasky#define DLT_RTAC_SERIAL 250 949335640Shselasky 950335640Shselasky/* 951335640Shselasky * Bluetooth Low Energy air interface link-layer packets. 952335640Shselasky * 953335640Shselasky * Requested by Mike Kershaw <dragorn@kismetwireless.net>. 954335640Shselasky */ 955335640Shselasky#define LINKTYPE_BLUETOOTH_LE_LL 251 956335640Shselasky 957335640Shselasky/* 958335640Shselasky * Link-layer header type for upper-protocol layer PDU saves from wireshark. 959335640Shselasky * 960335640Shselasky * the actual contents are determined by two TAGs stored with each 961335640Shselasky * packet: 962335640Shselasky * EXP_PDU_TAG_LINKTYPE the link type (LINKTYPE_ value) of the 963335640Shselasky * original packet. 964335640Shselasky * 965335640Shselasky * EXP_PDU_TAG_PROTO_NAME the name of the wireshark dissector 966335640Shselasky * that can make sense of the data stored. 967335640Shselasky */ 968335640Shselasky#define LINKTYPE_WIRESHARK_UPPER_PDU 252 969335640Shselasky 970335640Shselasky/* 971335640Shselasky * Link-layer header type for the netlink protocol (nlmon devices). 972335640Shselasky */ 973335640Shselasky#define LINKTYPE_NETLINK 253 974335640Shselasky 975335640Shselasky/* 976335640Shselasky * Bluetooth Linux Monitor headers for the BlueZ stack. 977335640Shselasky */ 978335640Shselasky#define LINKTYPE_BLUETOOTH_LINUX_MONITOR 254 979335640Shselasky 980335640Shselasky/* 981335640Shselasky * Bluetooth Basic Rate/Enhanced Data Rate baseband packets, as 982335640Shselasky * captured by Ubertooth. 983335640Shselasky */ 984335640Shselasky#define LINKTYPE_BLUETOOTH_BREDR_BB 255 985335640Shselasky 986335640Shselasky/* 987335640Shselasky * Bluetooth Low Energy link layer packets, as captured by Ubertooth. 988335640Shselasky */ 989335640Shselasky#define LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR 256 990335640Shselasky 991335640Shselasky/* 992335640Shselasky * PROFIBUS data link layer. 993335640Shselasky */ 994335640Shselasky#define LINKTYPE_PROFIBUS_DL 257 995335640Shselasky 996335640Shselasky/* 997335640Shselasky * Apple's DLT_PKTAP headers. 998335640Shselasky * 999335640Shselasky * Sadly, the folks at Apple either had no clue that the DLT_USERn values 1000335640Shselasky * are for internal use within an organization and partners only, and 1001335640Shselasky * didn't know that the right way to get a link-layer header type is to 1002335640Shselasky * ask tcpdump.org for one, or knew and didn't care, so they just 1003335640Shselasky * used DLT_USER2, which causes problems for everything except for 1004335640Shselasky * their version of tcpdump. 1005335640Shselasky * 1006335640Shselasky * So I'll just give them one; hopefully this will show up in a 1007335640Shselasky * libpcap release in time for them to get this into 10.10 Big Sur 1008335640Shselasky * or whatever Mavericks' successor is called. LINKTYPE_PKTAP 1009335640Shselasky * will be 258 *even on macOS*; that is *intentional*, so that 1010335640Shselasky * PKTAP files look the same on *all* OSes (different OSes can have 1011335640Shselasky * different numerical values for a given DLT_, but *MUST NOT* have 1012335640Shselasky * different values for what goes in a file, as files can be moved 1013335640Shselasky * between OSes!). 1014335640Shselasky */ 1015335640Shselasky#define LINKTYPE_PKTAP 258 1016335640Shselasky 1017335640Shselasky/* 1018335640Shselasky * Ethernet packets preceded by a header giving the last 6 octets 1019335640Shselasky * of the preamble specified by 802.3-2012 Clause 65, section 1020335640Shselasky * 65.1.3.2 "Transmit". 1021335640Shselasky */ 1022335640Shselasky#define LINKTYPE_EPON 259 1023335640Shselasky 1024335640Shselasky/* 1025335640Shselasky * IPMI trace packets, as specified by Table 3-20 "Trace Data Block Format" 1026335640Shselasky * in the PICMG HPM.2 specification. 1027335640Shselasky */ 1028335640Shselasky#define LINKTYPE_IPMI_HPM_2 260 1029335640Shselasky 1030335640Shselasky/* 1031335640Shselasky * per Joshua Wright <jwright@hasborg.com>, formats for Zwave captures. 1032335640Shselasky */ 1033335640Shselasky#define LINKTYPE_ZWAVE_R1_R2 261 1034335640Shselasky#define LINKTYPE_ZWAVE_R3 262 1035335640Shselasky 1036335640Shselasky/* 1037335640Shselasky * per Steve Karg <skarg@users.sourceforge.net>, formats for Wattstopper 1038335640Shselasky * Digital Lighting Management room bus serial protocol captures. 1039335640Shselasky */ 1040335640Shselasky#define LINKTYPE_WATTSTOPPER_DLM 263 1041335640Shselasky 1042335640Shselasky/* 1043335640Shselasky * ISO 14443 contactless smart card messages. 1044335640Shselasky */ 1045335640Shselasky#define LINKTYPE_ISO_14443 264 1046335640Shselasky 1047335640Shselasky/* 1048335640Shselasky * Radio data system (RDS) groups. IEC 62106. 1049335640Shselasky * Per Jonathan Brucker <jonathan.brucke@gmail.com>. 1050335640Shselasky */ 1051335640Shselasky#define LINKTYPE_RDS 265 1052335640Shselasky 1053335640Shselasky/* 1054335640Shselasky * USB packets, beginning with a Darwin (macOS, etc.) header. 1055335640Shselasky */ 1056335640Shselasky#define LINKTYPE_USB_DARWIN 266 1057335640Shselasky 1058335640Shselasky/* 1059335640Shselasky * OpenBSD DLT_OPENFLOW. 1060335640Shselasky */ 1061335640Shselasky#define LINKTYPE_OPENFLOW 267 1062335640Shselasky 1063335640Shselasky/* 1064335640Shselasky * SDLC frames containing SNA PDUs. 1065335640Shselasky */ 1066335640Shselasky#define LINKTYPE_SDLC 268 1067335640Shselasky 1068335640Shselasky/* 1069335640Shselasky * per "Selvig, Bjorn" <b.selvig@ti.com> used for 1070335640Shselasky * TI protocol sniffer. 1071335640Shselasky */ 1072335640Shselasky#define LINKTYPE_TI_LLN_SNIFFER 269 1073335640Shselasky 1074335640Shselasky/* 1075335640Shselasky * per: Erik de Jong <erikdejong at gmail.com> for 1076335640Shselasky * https://github.com/eriknl/LoRaTap/releases/tag/v0.1 1077335640Shselasky */ 1078335640Shselasky#define LINKTYPE_LORATAP 270 1079335640Shselasky 1080335640Shselasky/* 1081335640Shselasky * per: Stefanha at gmail.com for 1082335640Shselasky * http://lists.sandelman.ca/pipermail/tcpdump-workers/2017-May/000772.html 1083335640Shselasky * and: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/vsockmon.h 1084335640Shselasky * for: http://qemu-project.org/Features/VirtioVsock 1085335640Shselasky */ 1086335640Shselasky#define LINKTYPE_VSOCK 271 1087335640Shselasky 1088335640Shselasky/* 1089335640Shselasky * Nordic Semiconductor Bluetooth LE sniffer. 1090335640Shselasky */ 1091335640Shselasky#define LINKTYPE_NORDIC_BLE 272 1092335640Shselasky 1093335640Shselasky/* 1094335640Shselasky * Excentis DOCSIS 3.1 RF sniffer (XRA-31) 1095335640Shselasky * per: bruno.verstuyft at excentis.com 1096335640Shselasky * http://www.xra31.com/xra-header 1097335640Shselasky */ 1098335640Shselasky#define LINKTYPE_DOCSIS31_XRA31 273 1099335640Shselasky 1100335640Shselasky/* 1101335640Shselasky * mPackets, as specified by IEEE 802.3br Figure 99-4, starting 1102335640Shselasky * with the preamble and always ending with a CRC field. 1103335640Shselasky */ 1104335640Shselasky#define LINKTYPE_ETHERNET_MPACKET 274 1105335640Shselasky 1106335640Shselasky/* 1107335640Shselasky * DisplayPort AUX channel monitoring data as specified by VESA 1108335640Shselasky * DisplayPort(DP) Standard preceeded by a pseudo-header. 1109335640Shselasky * per dirk.eibach at gdsys.cc 1110335640Shselasky */ 1111335640Shselasky#define LINKTYPE_DISPLAYPORT_AUX 275 1112335640Shselasky 1113356341Scy/* 1114356341Scy * Linux cooked sockets v2. 1115356341Scy */ 1116356341Scy#define LINKTYPE_LINUX_SLL2 276 1117335640Shselasky 1118356341Scy#define LINKTYPE_MATCHING_MAX 276 /* highest value in the "matching" range */ 1119356341Scy 1120356341Scy/* 1121356341Scy * The DLT_ and LINKTYPE_ values in the "matching" range should be the 1122356341Scy * same, so DLT_MATCHING_MAX and LINKTYPE_MATCHING_MAX should be the 1123356341Scy * same. 1124356341Scy */ 1125356341Scy#if LINKTYPE_MATCHING_MAX != DLT_MATCHING_MAX 1126356341Scy#error The LINKTYPE_ matching range does not match the DLT_ matching range 1127356341Scy#endif 1128356341Scy 1129335640Shselaskystatic struct linktype_map { 1130335640Shselasky int dlt; 1131335640Shselasky int linktype; 1132335640Shselasky} map[] = { 1133335640Shselasky /* 1134335640Shselasky * These DLT_* codes have LINKTYPE_* codes with values identical 1135335640Shselasky * to the values of the corresponding DLT_* code. 1136335640Shselasky */ 1137335640Shselasky { DLT_NULL, LINKTYPE_NULL }, 1138335640Shselasky { DLT_EN10MB, LINKTYPE_ETHERNET }, 1139335640Shselasky { DLT_EN3MB, LINKTYPE_EXP_ETHERNET }, 1140335640Shselasky { DLT_AX25, LINKTYPE_AX25 }, 1141335640Shselasky { DLT_PRONET, LINKTYPE_PRONET }, 1142335640Shselasky { DLT_CHAOS, LINKTYPE_CHAOS }, 1143335640Shselasky { DLT_IEEE802, LINKTYPE_IEEE802_5 }, 1144335640Shselasky { DLT_ARCNET, LINKTYPE_ARCNET_BSD }, 1145335640Shselasky { DLT_SLIP, LINKTYPE_SLIP }, 1146335640Shselasky { DLT_PPP, LINKTYPE_PPP }, 1147335640Shselasky { DLT_FDDI, LINKTYPE_FDDI }, 1148335640Shselasky { DLT_SYMANTEC_FIREWALL, LINKTYPE_SYMANTEC_FIREWALL }, 1149335640Shselasky 1150335640Shselasky /* 1151335640Shselasky * These DLT_* codes have different values on different 1152335640Shselasky * platforms; we map them to LINKTYPE_* codes that 1153335640Shselasky * have values that should never be equal to any DLT_* 1154335640Shselasky * code. 1155335640Shselasky */ 1156335640Shselasky#ifdef DLT_FR 1157335640Shselasky /* BSD/OS Frame Relay */ 1158335640Shselasky { DLT_FR, LINKTYPE_FRELAY }, 1159335640Shselasky#endif 1160335640Shselasky 1161335640Shselasky { DLT_ATM_RFC1483, LINKTYPE_ATM_RFC1483 }, 1162335640Shselasky { DLT_RAW, LINKTYPE_RAW }, 1163335640Shselasky { DLT_SLIP_BSDOS, LINKTYPE_SLIP_BSDOS }, 1164335640Shselasky { DLT_PPP_BSDOS, LINKTYPE_PPP_BSDOS }, 1165335640Shselasky 1166335640Shselasky /* BSD/OS Cisco HDLC */ 1167335640Shselasky { DLT_C_HDLC, LINKTYPE_C_HDLC }, 1168335640Shselasky 1169335640Shselasky /* 1170335640Shselasky * These DLT_* codes are not on all platforms, but, so far, 1171335640Shselasky * there don't appear to be any platforms that define 1172335640Shselasky * other codes with those values; we map them to 1173335640Shselasky * different LINKTYPE_* values anyway, just in case. 1174335640Shselasky */ 1175335640Shselasky 1176335640Shselasky /* Linux ATM Classical IP */ 1177335640Shselasky { DLT_ATM_CLIP, LINKTYPE_ATM_CLIP }, 1178335640Shselasky 1179335640Shselasky /* NetBSD sync/async serial PPP (or Cisco HDLC) */ 1180335640Shselasky { DLT_PPP_SERIAL, LINKTYPE_PPP_HDLC }, 1181335640Shselasky 1182335640Shselasky /* NetBSD PPP over Ethernet */ 1183335640Shselasky { DLT_PPP_ETHER, LINKTYPE_PPP_ETHER }, 1184335640Shselasky 1185335640Shselasky /* 1186335640Shselasky * All LINKTYPE_ values between LINKTYPE_MATCHING_MIN 1187335640Shselasky * and LINKTYPE_MATCHING_MAX are mapped to identical 1188335640Shselasky * DLT_ values. 1189335640Shselasky */ 1190335640Shselasky 1191335640Shselasky { -1, -1 } 1192335640Shselasky}; 1193335640Shselasky 1194335640Shselaskyint 1195335640Shselaskydlt_to_linktype(int dlt) 1196335640Shselasky{ 1197335640Shselasky int i; 1198335640Shselasky 1199335640Shselasky /* 1200335640Shselasky * DLTs that, on some platforms, have values in the matching range 1201335640Shselasky * but that *don't* have the same value as the corresponding 1202335640Shselasky * LINKTYPE because, for some reason, not all OSes have the 1203335640Shselasky * same value for that DLT (note that the DLT's value might be 1204335640Shselasky * outside the matching range on some of those OSes). 1205335640Shselasky */ 1206335640Shselasky if (dlt == DLT_PFSYNC) 1207335640Shselasky return (LINKTYPE_PFSYNC); 1208335640Shselasky if (dlt == DLT_PKTAP) 1209335640Shselasky return (LINKTYPE_PKTAP); 1210335640Shselasky 1211335640Shselasky /* 1212335640Shselasky * For all other values in the matching range, the DLT 1213335640Shselasky * value is the same as the LINKTYPE value. 1214335640Shselasky */ 1215335640Shselasky if (dlt >= DLT_MATCHING_MIN && dlt <= DLT_MATCHING_MAX) 1216335640Shselasky return (dlt); 1217335640Shselasky 1218335640Shselasky /* 1219335640Shselasky * Map the values outside that range. 1220335640Shselasky */ 1221335640Shselasky for (i = 0; map[i].dlt != -1; i++) { 1222335640Shselasky if (map[i].dlt == dlt) 1223335640Shselasky return (map[i].linktype); 1224335640Shselasky } 1225335640Shselasky 1226335640Shselasky /* 1227335640Shselasky * If we don't have a mapping for this DLT, return an 1228335640Shselasky * error; that means that this is a value with no corresponding 1229335640Shselasky * LINKTYPE, and we need to assign one. 1230335640Shselasky */ 1231335640Shselasky return (-1); 1232335640Shselasky} 1233335640Shselasky 1234335640Shselaskyint 1235335640Shselaskylinktype_to_dlt(int linktype) 1236335640Shselasky{ 1237335640Shselasky int i; 1238335640Shselasky 1239335640Shselasky /* 1240335640Shselasky * LINKTYPEs in the matching range that *don't* 1241335640Shselasky * have the same value as the corresponding DLTs 1242335640Shselasky * because, for some reason, not all OSes have the 1243335640Shselasky * same value for that DLT. 1244335640Shselasky */ 1245335640Shselasky if (linktype == LINKTYPE_PFSYNC) 1246335640Shselasky return (DLT_PFSYNC); 1247335640Shselasky if (linktype == LINKTYPE_PKTAP) 1248335640Shselasky return (DLT_PKTAP); 1249335640Shselasky 1250335640Shselasky /* 1251335640Shselasky * For all other values in the matching range, the LINKTYPE 1252335640Shselasky * value is the same as the DLT value. 1253335640Shselasky */ 1254335640Shselasky if (linktype >= LINKTYPE_MATCHING_MIN && 1255335640Shselasky linktype <= LINKTYPE_MATCHING_MAX) 1256335640Shselasky return (linktype); 1257335640Shselasky 1258335640Shselasky /* 1259335640Shselasky * Map the values outside that range. 1260335640Shselasky */ 1261335640Shselasky for (i = 0; map[i].linktype != -1; i++) { 1262335640Shselasky if (map[i].linktype == linktype) 1263335640Shselasky return (map[i].dlt); 1264335640Shselasky } 1265335640Shselasky 1266335640Shselasky /* 1267335640Shselasky * If we don't have an entry for this LINKTYPE, return 1268335640Shselasky * the link type value; it may be a DLT from an older 1269335640Shselasky * version of libpcap. 1270335640Shselasky */ 1271335640Shselasky return linktype; 1272335640Shselasky} 1273335640Shselasky 1274335640Shselasky/* 1275335640Shselasky * Return the maximum snapshot length for a given DLT_ value. 1276335640Shselasky * 1277356341Scy * For most link-layer types, we use MAXIMUM_SNAPLEN. 1278335640Shselasky * 1279356341Scy * For DLT_DBUS, the maximum is 128MiB, as per 1280356341Scy * 1281335640Shselasky * https://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages 1282356341Scy * 1283356341Scy * For DLT_USBPCAP, the maximum is 1MiB, as per 1284356341Scy * 1285356341Scy * https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15985 1286335640Shselasky */ 1287335640Shselaskyu_int 1288335640Shselaskymax_snaplen_for_dlt(int dlt) 1289335640Shselasky{ 1290356341Scy switch (dlt) { 1291356341Scy 1292356341Scy case DLT_DBUS: 1293356341Scy return 128*1024*1024; 1294356341Scy 1295356341Scy case DLT_USBPCAP: 1296356341Scy return 1024*1024; 1297356341Scy 1298356341Scy default: 1299335640Shselasky return MAXIMUM_SNAPLEN; 1300356341Scy } 1301335640Shselasky} 1302335640Shselasky 1303335640Shselasky/* 1304335640Shselasky * DLT_LINUX_SLL packets with a protocol type of LINUX_SLL_P_CAN or 1305335640Shselasky * LINUX_SLL_P_CANFD have SocketCAN headers in front of the payload, 1306335640Shselasky * with the CAN ID being in host byte order. 1307335640Shselasky * 1308335640Shselasky * When reading a DLT_LINUX_SLL capture file, we need to check for those 1309335640Shselasky * packets and convert the CAN ID from the byte order of the host that 1310335640Shselasky * wrote the file to this host's byte order. 1311335640Shselasky */ 1312335640Shselaskystatic void 1313335640Shselaskyswap_linux_sll_header(const struct pcap_pkthdr *hdr, u_char *buf) 1314335640Shselasky{ 1315335640Shselasky u_int caplen = hdr->caplen; 1316335640Shselasky u_int length = hdr->len; 1317335640Shselasky struct sll_header *shdr = (struct sll_header *)buf; 1318335640Shselasky uint16_t protocol; 1319335640Shselasky pcap_can_socketcan_hdr *chdr; 1320335640Shselasky 1321335640Shselasky if (caplen < (u_int) sizeof(struct sll_header) || 1322335640Shselasky length < (u_int) sizeof(struct sll_header)) { 1323335640Shselasky /* Not enough data to have the protocol field */ 1324335640Shselasky return; 1325335640Shselasky } 1326335640Shselasky 1327335640Shselasky protocol = EXTRACT_16BITS(&shdr->sll_protocol); 1328335640Shselasky if (protocol != LINUX_SLL_P_CAN && protocol != LINUX_SLL_P_CANFD) 1329335640Shselasky return; 1330335640Shselasky 1331335640Shselasky /* 1332335640Shselasky * SocketCAN packet; fix up the packet's header. 1333335640Shselasky */ 1334335640Shselasky chdr = (pcap_can_socketcan_hdr *)(buf + sizeof(struct sll_header)); 1335335640Shselasky if (caplen < (u_int) sizeof(struct sll_header) + sizeof(chdr->can_id) || 1336335640Shselasky length < (u_int) sizeof(struct sll_header) + sizeof(chdr->can_id)) { 1337335640Shselasky /* Not enough data to have the CAN ID */ 1338335640Shselasky return; 1339335640Shselasky } 1340335640Shselasky chdr->can_id = SWAPLONG(chdr->can_id); 1341335640Shselasky} 1342335640Shselasky 1343335640Shselasky/* 1344335640Shselasky * The DLT_USB_LINUX and DLT_USB_LINUX_MMAPPED headers are in host 1345335640Shselasky * byte order when capturing (it's supplied directly from a 1346335640Shselasky * memory-mapped buffer shared by the kernel). 1347335640Shselasky * 1348335640Shselasky * When reading a DLT_USB_LINUX or DLT_USB_LINUX_MMAPPED capture file, 1349335640Shselasky * we need to convert it from the byte order of the host that wrote 1350335640Shselasky * the file to this host's byte order. 1351335640Shselasky */ 1352335640Shselaskystatic void 1353335640Shselaskyswap_linux_usb_header(const struct pcap_pkthdr *hdr, u_char *buf, 1354335640Shselasky int header_len_64_bytes) 1355335640Shselasky{ 1356335640Shselasky pcap_usb_header_mmapped *uhdr = (pcap_usb_header_mmapped *)buf; 1357335640Shselasky bpf_u_int32 offset = 0; 1358335640Shselasky 1359335640Shselasky /* 1360335640Shselasky * "offset" is the offset *past* the field we're swapping; 1361335640Shselasky * we skip the field *before* checking to make sure 1362335640Shselasky * the captured data length includes the entire field. 1363335640Shselasky */ 1364335640Shselasky 1365335640Shselasky /* 1366335640Shselasky * The URB id is a totally opaque value; do we really need to 1367335640Shselasky * convert it to the reading host's byte order??? 1368335640Shselasky */ 1369335640Shselasky offset += 8; /* skip past id */ 1370335640Shselasky if (hdr->caplen < offset) 1371335640Shselasky return; 1372335640Shselasky uhdr->id = SWAPLL(uhdr->id); 1373335640Shselasky 1374335640Shselasky offset += 4; /* skip past various 1-byte fields */ 1375335640Shselasky 1376335640Shselasky offset += 2; /* skip past bus_id */ 1377335640Shselasky if (hdr->caplen < offset) 1378335640Shselasky return; 1379335640Shselasky uhdr->bus_id = SWAPSHORT(uhdr->bus_id); 1380335640Shselasky 1381335640Shselasky offset += 2; /* skip past various 1-byte fields */ 1382335640Shselasky 1383335640Shselasky offset += 8; /* skip past ts_sec */ 1384335640Shselasky if (hdr->caplen < offset) 1385335640Shselasky return; 1386335640Shselasky uhdr->ts_sec = SWAPLL(uhdr->ts_sec); 1387335640Shselasky 1388335640Shselasky offset += 4; /* skip past ts_usec */ 1389335640Shselasky if (hdr->caplen < offset) 1390335640Shselasky return; 1391335640Shselasky uhdr->ts_usec = SWAPLONG(uhdr->ts_usec); 1392335640Shselasky 1393335640Shselasky offset += 4; /* skip past status */ 1394335640Shselasky if (hdr->caplen < offset) 1395335640Shselasky return; 1396335640Shselasky uhdr->status = SWAPLONG(uhdr->status); 1397335640Shselasky 1398335640Shselasky offset += 4; /* skip past urb_len */ 1399335640Shselasky if (hdr->caplen < offset) 1400335640Shselasky return; 1401335640Shselasky uhdr->urb_len = SWAPLONG(uhdr->urb_len); 1402335640Shselasky 1403335640Shselasky offset += 4; /* skip past data_len */ 1404335640Shselasky if (hdr->caplen < offset) 1405335640Shselasky return; 1406335640Shselasky uhdr->data_len = SWAPLONG(uhdr->data_len); 1407335640Shselasky 1408335640Shselasky if (uhdr->transfer_type == URB_ISOCHRONOUS) { 1409335640Shselasky offset += 4; /* skip past s.iso.error_count */ 1410335640Shselasky if (hdr->caplen < offset) 1411335640Shselasky return; 1412335640Shselasky uhdr->s.iso.error_count = SWAPLONG(uhdr->s.iso.error_count); 1413335640Shselasky 1414335640Shselasky offset += 4; /* skip past s.iso.numdesc */ 1415335640Shselasky if (hdr->caplen < offset) 1416335640Shselasky return; 1417335640Shselasky uhdr->s.iso.numdesc = SWAPLONG(uhdr->s.iso.numdesc); 1418335640Shselasky } else 1419335640Shselasky offset += 8; /* skip USB setup header */ 1420335640Shselasky 1421335640Shselasky /* 1422335640Shselasky * With the old header, there are no isochronous descriptors 1423335640Shselasky * after the header. 1424335640Shselasky * 1425335640Shselasky * With the new header, the actual number of descriptors in 1426335640Shselasky * the header is not s.iso.numdesc, it's ndesc - only the 1427335640Shselasky * first N descriptors, for some value of N, are put into 1428335640Shselasky * the header, and ndesc is set to the actual number copied. 1429335640Shselasky * In addition, if s.iso.numdesc is negative, no descriptors 1430335640Shselasky * are captured, and ndesc is set to 0. 1431335640Shselasky */ 1432335640Shselasky if (header_len_64_bytes) { 1433335640Shselasky /* 1434335640Shselasky * This is either the "version 1" header, with 1435335640Shselasky * 16 bytes of additional fields at the end, or 1436335640Shselasky * a "version 0" header from a memory-mapped 1437335640Shselasky * capture, with 16 bytes of zeroed-out padding 1438335640Shselasky * at the end. Byte swap them as if this were 1439335640Shselasky * a "version 1" header. 1440335640Shselasky */ 1441335640Shselasky offset += 4; /* skip past interval */ 1442335640Shselasky if (hdr->caplen < offset) 1443335640Shselasky return; 1444335640Shselasky uhdr->interval = SWAPLONG(uhdr->interval); 1445335640Shselasky 1446335640Shselasky offset += 4; /* skip past start_frame */ 1447335640Shselasky if (hdr->caplen < offset) 1448335640Shselasky return; 1449335640Shselasky uhdr->start_frame = SWAPLONG(uhdr->start_frame); 1450335640Shselasky 1451335640Shselasky offset += 4; /* skip past xfer_flags */ 1452335640Shselasky if (hdr->caplen < offset) 1453335640Shselasky return; 1454335640Shselasky uhdr->xfer_flags = SWAPLONG(uhdr->xfer_flags); 1455335640Shselasky 1456335640Shselasky offset += 4; /* skip past ndesc */ 1457335640Shselasky if (hdr->caplen < offset) 1458335640Shselasky return; 1459335640Shselasky uhdr->ndesc = SWAPLONG(uhdr->ndesc); 1460335640Shselasky 1461335640Shselasky if (uhdr->transfer_type == URB_ISOCHRONOUS) { 1462335640Shselasky /* swap the values in struct linux_usb_isodesc */ 1463335640Shselasky usb_isodesc *pisodesc; 1464335640Shselasky uint32_t i; 1465335640Shselasky 1466335640Shselasky pisodesc = (usb_isodesc *)(void *)(buf+offset); 1467335640Shselasky for (i = 0; i < uhdr->ndesc; i++) { 1468335640Shselasky offset += 4; /* skip past status */ 1469335640Shselasky if (hdr->caplen < offset) 1470335640Shselasky return; 1471335640Shselasky pisodesc->status = SWAPLONG(pisodesc->status); 1472335640Shselasky 1473335640Shselasky offset += 4; /* skip past offset */ 1474335640Shselasky if (hdr->caplen < offset) 1475335640Shselasky return; 1476335640Shselasky pisodesc->offset = SWAPLONG(pisodesc->offset); 1477335640Shselasky 1478335640Shselasky offset += 4; /* skip past len */ 1479335640Shselasky if (hdr->caplen < offset) 1480335640Shselasky return; 1481335640Shselasky pisodesc->len = SWAPLONG(pisodesc->len); 1482335640Shselasky 1483335640Shselasky offset += 4; /* skip past padding */ 1484335640Shselasky 1485335640Shselasky pisodesc++; 1486335640Shselasky } 1487335640Shselasky } 1488335640Shselasky } 1489335640Shselasky} 1490335640Shselasky 1491335640Shselasky/* 1492335640Shselasky * The DLT_NFLOG "packets" have a mixture of big-endian and host-byte-order 1493335640Shselasky * data. They begin with a fixed-length header with big-endian fields, 1494335640Shselasky * followed by a set of TLVs, where the type and length are in host 1495335640Shselasky * byte order but the values are either big-endian or are a raw byte 1496335640Shselasky * sequence that's the same regardless of the host's byte order. 1497335640Shselasky * 1498335640Shselasky * When reading a DLT_NFLOG capture file, we need to convert the type 1499335640Shselasky * and length values from the byte order of the host that wrote the 1500335640Shselasky * file to the byte order of this host. 1501335640Shselasky */ 1502335640Shselaskystatic void 1503335640Shselaskyswap_nflog_header(const struct pcap_pkthdr *hdr, u_char *buf) 1504335640Shselasky{ 1505335640Shselasky u_char *p = buf; 1506335640Shselasky nflog_hdr_t *nfhdr = (nflog_hdr_t *)buf; 1507335640Shselasky nflog_tlv_t *tlv; 1508335640Shselasky u_int caplen = hdr->caplen; 1509335640Shselasky u_int length = hdr->len; 1510335640Shselasky uint16_t size; 1511335640Shselasky 1512335640Shselasky if (caplen < (u_int) sizeof(nflog_hdr_t) || 1513335640Shselasky length < (u_int) sizeof(nflog_hdr_t)) { 1514335640Shselasky /* Not enough data to have any TLVs. */ 1515335640Shselasky return; 1516335640Shselasky } 1517335640Shselasky 1518335640Shselasky if (nfhdr->nflog_version != 0) { 1519335640Shselasky /* Unknown NFLOG version */ 1520335640Shselasky return; 1521335640Shselasky } 1522335640Shselasky 1523335640Shselasky length -= sizeof(nflog_hdr_t); 1524335640Shselasky caplen -= sizeof(nflog_hdr_t); 1525335640Shselasky p += sizeof(nflog_hdr_t); 1526335640Shselasky 1527335640Shselasky while (caplen >= sizeof(nflog_tlv_t)) { 1528335640Shselasky tlv = (nflog_tlv_t *) p; 1529335640Shselasky 1530335640Shselasky /* Swap the type and length. */ 1531335640Shselasky tlv->tlv_type = SWAPSHORT(tlv->tlv_type); 1532335640Shselasky tlv->tlv_length = SWAPSHORT(tlv->tlv_length); 1533335640Shselasky 1534335640Shselasky /* Get the length of the TLV. */ 1535335640Shselasky size = tlv->tlv_length; 1536335640Shselasky if (size % 4 != 0) 1537335640Shselasky size += 4 - size % 4; 1538335640Shselasky 1539335640Shselasky /* Is the TLV's length less than the minimum? */ 1540335640Shselasky if (size < sizeof(nflog_tlv_t)) { 1541335640Shselasky /* Yes. Give up now. */ 1542335640Shselasky return; 1543335640Shselasky } 1544335640Shselasky 1545335640Shselasky /* Do we have enough data for the full TLV? */ 1546335640Shselasky if (caplen < size || length < size) { 1547335640Shselasky /* No. */ 1548335640Shselasky return; 1549335640Shselasky } 1550335640Shselasky 1551335640Shselasky /* Skip over the TLV. */ 1552335640Shselasky length -= size; 1553335640Shselasky caplen -= size; 1554335640Shselasky p += size; 1555335640Shselasky } 1556335640Shselasky} 1557335640Shselasky 1558335640Shselaskyvoid 1559335640Shselaskyswap_pseudo_headers(int linktype, struct pcap_pkthdr *hdr, u_char *data) 1560335640Shselasky{ 1561335640Shselasky /* 1562335640Shselasky * Convert pseudo-headers from the byte order of 1563335640Shselasky * the host on which the file was saved to our 1564335640Shselasky * byte order, as necessary. 1565335640Shselasky */ 1566335640Shselasky switch (linktype) { 1567335640Shselasky 1568335640Shselasky case DLT_LINUX_SLL: 1569335640Shselasky swap_linux_sll_header(hdr, data); 1570335640Shselasky break; 1571335640Shselasky 1572335640Shselasky case DLT_USB_LINUX: 1573335640Shselasky swap_linux_usb_header(hdr, data, 0); 1574335640Shselasky break; 1575335640Shselasky 1576335640Shselasky case DLT_USB_LINUX_MMAPPED: 1577335640Shselasky swap_linux_usb_header(hdr, data, 1); 1578335640Shselasky break; 1579335640Shselasky 1580335640Shselasky case DLT_NFLOG: 1581335640Shselasky swap_nflog_header(hdr, data); 1582335640Shselasky break; 1583335640Shselasky } 1584335640Shselasky} 1585