1/* 2 * Copyright (c) 2000-2014 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28/* 29 * Copyright (c) 1990, 1991, 1993 30 * The Regents of the University of California. All rights reserved. 31 * 32 * This code is derived from the Stanford/CMU enet packet filter, 33 * (net/enet.c) distributed as part of 4.3BSD, and code contributed 34 * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence 35 * Berkeley Laboratory. 36 * 37 * Redistribution and use in source and binary forms, with or without 38 * modification, are permitted provided that the following conditions 39 * are met: 40 * 1. Redistributions of source code must retain the above copyright 41 * notice, this list of conditions and the following disclaimer. 42 * 2. Redistributions in binary form must reproduce the above copyright 43 * notice, this list of conditions and the following disclaimer in the 44 * documentation and/or other materials provided with the distribution. 45 * 3. All advertising materials mentioning features or use of this software 46 * must display the following acknowledgement: 47 * This product includes software developed by the University of 48 * California, Berkeley and its contributors. 49 * 4. Neither the name of the University nor the names of its contributors 50 * may be used to endorse or promote products derived from this software 51 * without specific prior written permission. 52 * 53 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 56 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 57 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 58 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 59 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 60 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 61 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 62 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 63 * SUCH DAMAGE. 64 * 65 * @(#)bpf.h 8.1 (Berkeley) 6/10/93 66 * @(#)bpf.h 1.34 (LBL) 6/16/96 67 * 68 * $FreeBSD: src/sys/net/bpf.h,v 1.21.2.3 2001/08/01 00:23:13 fenner Exp $ 69 */ 70/* 71 * NOTICE: This file was modified by SPARTA, Inc. in 2006 to introduce 72 * support for mandatory and extensible security protections. This notice 73 * is included in support of clause 2.2 (b) of the Apple Public License, 74 * Version 2.0. 75 */ 76 77#ifndef _NET_BPF_H_ 78#define _NET_BPF_H_ 79#include <sys/param.h> 80#include <sys/appleapiopts.h> 81#include <sys/types.h> 82#include <sys/time.h> 83#include <sys/cdefs.h> 84#include <stdint.h> 85 86#ifdef KERNEL 87#include <sys/kernel_types.h> 88#endif 89 90/* BSD style release date */ 91#define BPF_RELEASE 199606 92 93typedef int32_t bpf_int32; 94typedef u_int32_t bpf_u_int32; 95 96/* 97 * Alignment macros. BPF_WORDALIGN rounds up to the next 98 * even multiple of BPF_ALIGNMENT. 99 */ 100#define BPF_ALIGNMENT sizeof(int32_t) 101#define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1)) 102 103#define BPF_MAXINSNS 512 104#define BPF_MAXBUFSIZE 0x80000 105#define BPF_MINBUFSIZE 32 106 107/* 108 * Structure for BIOCSETF. 109 */ 110struct bpf_program { 111 u_int bf_len; 112 struct bpf_insn *bf_insns; 113}; 114 115#ifdef KERNEL_PRIVATE 116/* LP64 version of bpf_program. all pointers 117 * grow when we're dealing with a 64-bit process. 118 * WARNING - keep in sync with bpf_program 119 */ 120struct bpf_program64 { 121 u_int bf_len; 122 user64_addr_t bf_insns __attribute__((aligned(8))); 123}; 124 125struct bpf_program32 { 126 u_int bf_len; 127 user32_addr_t bf_insns; 128}; 129#endif /* KERNEL_PRIVATE */ 130 131/* 132 * Struct returned by BIOCGSTATS. 133 */ 134struct bpf_stat { 135 u_int bs_recv; /* number of packets received */ 136 u_int bs_drop; /* number of packets dropped */ 137}; 138 139/* 140 * Struct return by BIOCVERSION. This represents the version number of 141 * the filter language described by the instruction encodings below. 142 * bpf understands a program iff kernel_major == filter_major && 143 * kernel_minor >= filter_minor, that is, if the value returned by the 144 * running kernel has the same major number and a minor number equal 145 * equal to or less than the filter being downloaded. Otherwise, the 146 * results are undefined, meaning an error may be returned or packets 147 * may be accepted haphazardly. 148 * It has nothing to do with the source code version. 149 */ 150struct bpf_version { 151 u_short bv_major; 152 u_short bv_minor; 153}; 154#if defined(__LP64__) 155#include <sys/_types/_timeval32.h> 156 157#define BPF_TIMEVAL timeval32 158#else 159#define BPF_TIMEVAL timeval 160#endif /* __LP64__ */ 161/* Current version number of filter architecture. */ 162#define BPF_MAJOR_VERSION 1 163#define BPF_MINOR_VERSION 1 164 165#define BIOCGBLEN _IOR('B',102, u_int) 166#define BIOCSBLEN _IOWR('B',102, u_int) 167#define BIOCSETF _IOW('B',103, struct bpf_program) 168#ifdef KERNEL_PRIVATE 169#define BIOCSETF64 _IOW('B',103, struct bpf_program64) 170#define BIOCSETF32 _IOW('B',103, struct bpf_program32) 171#endif /* KERNEL_PRIVATE */ 172#define BIOCFLUSH _IO('B',104) 173#define BIOCPROMISC _IO('B',105) 174#define BIOCGDLT _IOR('B',106, u_int) 175#define BIOCGETIF _IOR('B',107, struct ifreq) 176#define BIOCSETIF _IOW('B',108, struct ifreq) 177#define BIOCSRTIMEOUT _IOW('B',109, struct timeval) 178#ifdef KERNEL_PRIVATE 179#define BIOCSRTIMEOUT64 _IOW('B',109, struct user64_timeval) 180#define BIOCSRTIMEOUT32 _IOW('B',109, struct user32_timeval) 181#endif /* KERNEL_PRIVATE */ 182#define BIOCGRTIMEOUT _IOR('B',110, struct timeval) 183#ifdef KERNEL_PRIVATE 184#define BIOCGRTIMEOUT64 _IOR('B',110, struct user64_timeval) 185#define BIOCGRTIMEOUT32 _IOR('B',110, struct user32_timeval) 186#endif /* KERNEL_PRIVATE */ 187#define BIOCGSTATS _IOR('B',111, struct bpf_stat) 188#define BIOCIMMEDIATE _IOW('B',112, u_int) 189#define BIOCVERSION _IOR('B',113, struct bpf_version) 190#define BIOCGRSIG _IOR('B',114, u_int) 191#define BIOCSRSIG _IOW('B',115, u_int) 192#define BIOCGHDRCMPLT _IOR('B',116, u_int) 193#define BIOCSHDRCMPLT _IOW('B',117, u_int) 194#define BIOCGSEESENT _IOR('B',118, u_int) 195#define BIOCSSEESENT _IOW('B',119, u_int) 196#define BIOCSDLT _IOW('B',120, u_int) 197#define BIOCGDLTLIST _IOWR('B',121, struct bpf_dltlist) 198#ifdef PRIVATE 199#define BIOCGETTC _IOR('B', 122, int) 200#define BIOCSETTC _IOW('B', 123, int) 201#define BIOCSEXTHDR _IOW('B', 124, u_int) 202#define BIOCGIFATTACHCOUNT _IOWR('B', 125, struct ifreq) 203#endif /* PRIVATE */ 204#define BIOCSETFNR _IOW('B', 126, struct bpf_program) 205#ifdef KERNEL_PRIVATE 206#define BIOCSETFNR64 _IOW('B',126, struct bpf_program64) 207#define BIOCSETFNR32 _IOW('B',126, struct bpf_program32) 208#endif /* KERNEL_PRIVATE */ 209#ifdef PRIVATE 210#define BIOCGWANTPKTAP _IOR('B', 127, u_int) 211#define BIOCSWANTPKTAP _IOWR('B', 127, u_int) 212#endif /* PRIVATE */ 213/* 214 * Structure prepended to each packet. 215 */ 216struct bpf_hdr { 217 struct BPF_TIMEVAL bh_tstamp; /* time stamp */ 218 bpf_u_int32 bh_caplen; /* length of captured portion */ 219 bpf_u_int32 bh_datalen; /* original length of packet */ 220 u_short bh_hdrlen; /* length of bpf header (this struct 221 plus alignment padding) */ 222}; 223#ifdef KERNEL 224/* 225 * Because the structure above is not a multiple of 4 bytes, some compilers 226 * will insist on inserting padding; hence, sizeof(struct bpf_hdr) won't work. 227 * Only the kernel needs to know about it; applications use bh_hdrlen. 228 */ 229#define SIZEOF_BPF_HDR (sizeof(struct bpf_hdr) <= 20 ? 18 : \ 230 sizeof(struct bpf_hdr)) 231#endif 232#ifdef PRIVATE 233/* 234 * This structure must be a multiple of 4 bytes. 235 * It includes padding and spare fields that we can use later if desired. 236 */ 237struct bpf_hdr_ext { 238 struct BPF_TIMEVAL bh_tstamp; /* time stamp */ 239 bpf_u_int32 bh_caplen; /* length of captured portion */ 240 bpf_u_int32 bh_datalen; /* original length of packet */ 241 u_short bh_hdrlen; /* length of bpf header */ 242 u_short bh_flags; 243#define BPF_HDR_EXT_FLAGS_DIR_IN 0x0000 244#define BPF_HDR_EXT_FLAGS_DIR_OUT 0x0001 245 pid_t bh_pid; /* process PID */ 246 char bh_comm[MAXCOMLEN+1]; /* process command */ 247 u_char _bh_pad2[2]; 248 u_char bh_proto; /* kernel reserved; 0 in userland */ 249 bpf_u_int32 bh_svc; /* service class */ 250 bpf_u_int32 bh_flowid; /* kernel reserved; 0 in userland */ 251}; 252 253#define BPF_CONTROL_NAME "com.apple.net.bpf" 254 255struct bpf_mtag { 256 char bt_comm[MAXCOMLEN]; 257 pid_t bt_pid; 258 bpf_u_int32 bt_svc; 259 unsigned char bt_direction; 260#define BPF_MTAG_DIR_IN 0 261#define BPF_MTAG_DIR_OUT 1 262}; 263#endif /* PRIVATE */ 264 265/* 266 * Data-link level type codes. 267 */ 268#define DLT_NULL 0 /* no link-layer encapsulation */ 269#define DLT_EN10MB 1 /* Ethernet (10Mb) */ 270#define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */ 271#define DLT_AX25 3 /* Amateur Radio AX.25 */ 272#define DLT_PRONET 4 /* Proteon ProNET Token Ring */ 273#define DLT_CHAOS 5 /* Chaos */ 274#define DLT_IEEE802 6 /* IEEE 802 Networks */ 275#define DLT_ARCNET 7 /* ARCNET */ 276#define DLT_SLIP 8 /* Serial Line IP */ 277#define DLT_PPP 9 /* Point-to-point Protocol */ 278#define DLT_FDDI 10 /* FDDI */ 279#define DLT_ATM_RFC1483 11 /* LLC/SNAP encapsulated atm */ 280#define DLT_RAW 12 /* raw IP */ 281 282/* 283 * These are values from BSD/OS's "bpf.h". 284 * These are not the same as the values from the traditional libpcap 285 * "bpf.h"; however, these values shouldn't be generated by any 286 * OS other than BSD/OS, so the correct values to use here are the 287 * BSD/OS values. 288 * 289 * Platforms that have already assigned these values to other 290 * DLT_ codes, however, should give these codes the values 291 * from that platform, so that programs that use these codes will 292 * continue to compile - even though they won't correctly read 293 * files of these types. 294 */ 295#define DLT_SLIP_BSDOS 15 /* BSD/OS Serial Line IP */ 296#define DLT_PPP_BSDOS 16 /* BSD/OS Point-to-point Protocol */ 297 298/* 299 * 17 was used for DLT_PFLOG in OpenBSD; it no longer is. 300 * 301 * It was DLT_LANE8023 in SuSE 6.3, so we defined LINKTYPE_PFLOG 302 * as 117 so that pflog captures would use a link-layer header type 303 * value that didn't collide with any other values. On all 304 * platforms other than OpenBSD, we defined DLT_PFLOG as 117, 305 * and we mapped between LINKTYPE_PFLOG and DLT_PFLOG. 306 * 307 * OpenBSD eventually switched to using 117 for DLT_PFLOG as well. 308 * 309 * Don't use 17 for anything else. 310 */ 311 312/* 313 * 18 is used for DLT_PFSYNC in OpenBSD, NetBSD, DragonFly BSD and 314 * Mac OS X; don't use it for anything else. (FreeBSD uses 121, 315 * which collides with DLT_HHDLC, even though it doesn't use 18 316 * for anything and doesn't appear to have ever used it for anything.) 317 * 318 * We define it as 18 on those platforms; it is, unfortunately, used 319 * for DLT_CIP in Suse 6.3, so we don't define it as DLT_PFSYNC 320 * in general. As the packet format for it, like that for 321 * DLT_PFLOG, is not only OS-dependent but OS-version-dependent, 322 * we don't support printing it in tcpdump except on OSes that 323 * have the relevant header files, so it's not that useful on 324 * other platforms. 325 */ 326#define DLT_PFSYNC 18 /* Packet filter state syncing */ 327 328#define DLT_ATM_CLIP 19 /* Linux Classical-IP over ATM */ 329 330/* 331 * These values are defined by NetBSD; other platforms should refrain from 332 * using them for other purposes, so that NetBSD savefiles with link 333 * types of 50 or 51 can be read as this type on all platforms. 334 */ 335#define DLT_PPP_SERIAL 50 /* PPP over serial with HDLC encapsulation */ 336#define DLT_PPP_ETHER 51 /* PPP over Ethernet */ 337 338/* 339 * The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses 340 * a link-layer type of 99 for the tcpdump it supplies. The link-layer 341 * header has 6 bytes of unknown data, something that appears to be an 342 * Ethernet type, and 36 bytes that appear to be 0 in at least one capture 343 * I've seen. 344 */ 345#define DLT_SYMANTEC_FIREWALL 99 346 347/* 348 * Values between 100 and 103 are used in capture file headers as 349 * link-layer header type LINKTYPE_ values corresponding to DLT_ types 350 * that differ between platforms; don't use those values for new DLT_ 351 * new types. 352 */ 353 354/* 355 * Values starting with 104 are used for newly-assigned link-layer 356 * header type values; for those link-layer header types, the DLT_ 357 * value returned by pcap_datalink() and passed to pcap_open_dead(), 358 * and the LINKTYPE_ value that appears in capture files, are the 359 * same. 360 * 361 * DLT_MATCHING_MIN is the lowest such value; DLT_MATCHING_MAX is 362 * the highest such value. 363 */ 364#define DLT_MATCHING_MIN 104 365 366/* 367 * This value was defined by libpcap 0.5; platforms that have defined 368 * it with a different value should define it here with that value - 369 * a link type of 104 in a save file will be mapped to DLT_C_HDLC, 370 * whatever value that happens to be, so programs will correctly 371 * handle files with that link type regardless of the value of 372 * DLT_C_HDLC. 373 * 374 * The name DLT_C_HDLC was used by BSD/OS; we use that name for source 375 * compatibility with programs written for BSD/OS. 376 * 377 * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well, 378 * for source compatibility with programs written for libpcap 0.5. 379 */ 380#define DLT_C_HDLC 104 /* Cisco HDLC */ 381#define DLT_CHDLC DLT_C_HDLC 382 383#define DLT_IEEE802_11 105 /* IEEE 802.11 wireless */ 384 385/* 386 * Values between 106 and 107 are used in capture file headers as 387 * link-layer types corresponding to DLT_ types that might differ 388 * between platforms; don't use those values for new DLT_ new types. 389 */ 390 391/* 392 * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides 393 * with other values. 394 * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header 395 * (DLCI, etc.). 396 */ 397#define DLT_FRELAY 107 398 399/* 400 * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except 401 * that the AF_ type in the link-layer header is in network byte order. 402 * 403 * OpenBSD defines it as 12, but that collides with DLT_RAW, so we 404 * define it as 108 here. If OpenBSD picks up this file, it should 405 * define DLT_LOOP as 12 in its version, as per the comment above - 406 * and should not use 108 for any purpose. 407 */ 408#define DLT_LOOP 108 409 410/* 411 * Values between 109 and 112 are used in capture file headers as 412 * link-layer types corresponding to DLT_ types that might differ 413 * between platforms; don't use those values for new DLT_ new types. 414 */ 415 416/* 417 * Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's 418 * DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other 419 * than OpenBSD. 420 */ 421#define DLT_ENC 109 422 423/* 424 * This is for Linux cooked sockets. 425 */ 426#define DLT_LINUX_SLL 113 427 428/* 429 * Apple LocalTalk hardware. 430 */ 431#define DLT_LTALK 114 432 433/* 434 * Acorn Econet. 435 */ 436#define DLT_ECONET 115 437 438/* 439 * Reserved for use with OpenBSD ipfilter. 440 */ 441#define DLT_IPFILTER 116 442 443/* 444 * For use in capture-file headers as a link-layer type corresponding 445 * to OpenBSD PF (Packet Filter) log. 446 */ 447#define DLT_PFLOG 117 448 449/* 450 * Registered for Cisco-internal use. 451 */ 452#define DLT_CISCO_IOS 118 453 454/* 455 * Reserved for 802.11 cards using the Prism II chips, with a link-layer 456 * header including Prism monitor mode information plus an 802.11 457 * header. 458 */ 459#define DLT_PRISM_HEADER 119 460 461/* 462 * Reserved for Aironet 802.11 cards, with an Aironet link-layer header 463 * (see Doug Ambrisko's FreeBSD patches). 464 */ 465#define DLT_AIRONET_HEADER 120 466 467/* 468 * Reserved for Siemens HiPath HDLC. XXX 469 */ 470#define DLT_HHDLC 121 471 472/* 473 * Reserved for RFC 2625 IP-over-Fibre Channel. 474 */ 475#define DLT_IP_OVER_FC 122 476 477/* 478 * Reserved for Full Frontal ATM on Solaris. 479 */ 480#define DLT_SUNATM 123 481 482/* 483 * Reserved as per request from Kent Dahlgren <kent@praesum.com> 484 * for private use. 485 */ 486#define DLT_RIO 124 /* RapidIO */ 487#define DLT_PCI_EXP 125 /* PCI Express */ 488#define DLT_AURORA 126 /* Xilinx Aurora link layer */ 489 490/* 491 * BSD header for 802.11 plus a number of bits of link-layer information 492 * including radio information. 493 */ 494#ifndef DLT_IEEE802_11_RADIO 495#define DLT_IEEE802_11_RADIO 127 496#endif 497 498/* 499 * Reserved for TZSP encapsulation. 500 */ 501#define DLT_TZSP 128 /* Tazmen Sniffer Protocol */ 502 503/* 504 * Reserved for Linux ARCNET. 505 */ 506#define DLT_ARCNET_LINUX 129 507 508/* 509 * Juniper-private data link types. 510 */ 511#define DLT_JUNIPER_MLPPP 130 512#define DLT_JUNIPER_MLFR 131 513#define DLT_JUNIPER_ES 132 514#define DLT_JUNIPER_GGSN 133 515#define DLT_JUNIPER_MFR 134 516#define DLT_JUNIPER_ATM2 135 517#define DLT_JUNIPER_SERVICES 136 518#define DLT_JUNIPER_ATM1 137 519 520/* 521 * Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund 522 * <dieter@apple.com>. The header that's presented is an Ethernet-like 523 * header: 524 * 525 * #define FIREWIRE_EUI64_LEN 8 526 * struct firewire_header { 527 * u_char firewire_dhost[FIREWIRE_EUI64_LEN]; 528 * u_char firewire_shost[FIREWIRE_EUI64_LEN]; 529 * u_short firewire_type; 530 * }; 531 * 532 * with "firewire_type" being an Ethernet type value, rather than, 533 * for example, raw GASP frames being handed up. 534 */ 535#define DLT_APPLE_IP_OVER_IEEE1394 138 536 537/* 538 * Various SS7 encapsulations, as per a request from Jeff Morriss 539 * <jeff.morriss[AT]ulticom.com> and subsequent discussions. 540 */ 541#define DLT_MTP2_WITH_PHDR 139 /* pseudo-header with various info, followed by MTP2 */ 542#define DLT_MTP2 140 /* MTP2, without pseudo-header */ 543#define DLT_MTP3 141 /* MTP3, without pseudo-header or MTP2 */ 544#define DLT_SCCP 142 /* SCCP, without pseudo-header or MTP2 or MTP3 */ 545 546/* 547 * Reserved for DOCSIS. 548 */ 549#define DLT_DOCSIS 143 550 551/* 552 * Reserved for Linux IrDA. 553 */ 554#define DLT_LINUX_IRDA 144 555 556/* 557 * Reserved for IBM SP switch and IBM Next Federation switch. 558 */ 559#define DLT_IBM_SP 145 560#define DLT_IBM_SN 146 561 562/* 563 * Reserved for private use. If you have some link-layer header type 564 * that you want to use within your organization, with the capture files 565 * using that link-layer header type not ever be sent outside your 566 * organization, you can use these values. 567 * 568 * No libpcap release will use these for any purpose, nor will any 569 * tcpdump release use them, either. 570 * 571 * Do *NOT* use these in capture files that you expect anybody not using 572 * your private versions of capture-file-reading tools to read; in 573 * particular, do *NOT* use them in products, otherwise you may find that 574 * people won't be able to use tcpdump, or snort, or Ethereal, or... to 575 * read capture files from your firewall/intrusion detection/traffic 576 * monitoring/etc. appliance, or whatever product uses that DLT_ value, 577 * and you may also find that the developers of those applications will 578 * not accept patches to let them read those files. 579 * 580 * Also, do not use them if somebody might send you a capture using them 581 * for *their* private type and tools using them for *your* private type 582 * would have to read them. 583 * 584 * Instead, ask "tcpdump-workers@tcpdump.org" for a new DLT_ value, 585 * as per the comment above, and use the type you're given. 586 */ 587#define DLT_USER0 147 588#define DLT_USER1 148 589#define DLT_USER2 149 590#define DLT_USER3 150 591#define DLT_USER4 151 592#define DLT_USER5 152 593#define DLT_USER6 153 594#define DLT_USER7 154 595#define DLT_USER8 155 596#define DLT_USER9 156 597#define DLT_USER10 157 598#define DLT_USER11 158 599#define DLT_USER12 159 600#define DLT_USER13 160 601#define DLT_USER14 161 602#define DLT_USER15 162 603 604#ifdef PRIVATE 605/* 606 * For Apple private usage 607 */ 608#define DLT_PKTAP DLT_USER2 /* rdar://11779467 */ 609#endif /* PRIVATE */ 610 611/* 612 * For future use with 802.11 captures - defined by AbsoluteValue 613 * Systems to store a number of bits of link-layer information 614 * including radio information: 615 * 616 * http://www.shaftnet.org/~pizza/software/capturefrm.txt 617 * 618 * but it might be used by some non-AVS drivers now or in the 619 * future. 620 */ 621#define DLT_IEEE802_11_RADIO_AVS 163 /* 802.11 plus AVS radio header */ 622 623/* 624 * Juniper-private data link type, as per request from 625 * Hannes Gredler <hannes@juniper.net>. The DLT_s are used 626 * for passing on chassis-internal metainformation such as 627 * QOS profiles, etc.. 628 */ 629#define DLT_JUNIPER_MONITOR 164 630 631/* 632 * Reserved for BACnet MS/TP. 633 */ 634#define DLT_BACNET_MS_TP 165 635 636/* 637 * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>. 638 * 639 * This is used in some OSes to allow a kernel socket filter to distinguish 640 * between incoming and outgoing packets, on a socket intended to 641 * supply pppd with outgoing packets so it can do dial-on-demand and 642 * hangup-on-lack-of-demand; incoming packets are filtered out so they 643 * don't cause pppd to hold the connection up (you don't want random 644 * input packets such as port scans, packets from old lost connections, 645 * etc. to force the connection to stay up). 646 * 647 * The first byte of the PPP header (0xff03) is modified to accomodate 648 * the direction - 0x00 = IN, 0x01 = OUT. 649 */ 650#define DLT_PPP_PPPD 166 651 652/* 653 * Names for backwards compatibility with older versions of some PPP 654 * software; new software should use DLT_PPP_PPPD. 655 */ 656#define DLT_PPP_WITH_DIRECTION DLT_PPP_PPPD 657#define DLT_LINUX_PPP_WITHDIRECTION DLT_PPP_PPPD 658 659/* 660 * Juniper-private data link type, as per request from 661 * Hannes Gredler <hannes@juniper.net>. The DLT_s are used 662 * for passing on chassis-internal metainformation such as 663 * QOS profiles, cookies, etc.. 664 */ 665#define DLT_JUNIPER_PPPOE 167 666#define DLT_JUNIPER_PPPOE_ATM 168 667 668#define DLT_GPRS_LLC 169 /* GPRS LLC */ 669#define DLT_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */ 670#define DLT_GPF_F 171 /* GPF-F (ITU-T G.7041/Y.1303) */ 671 672/* 673 * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line 674 * monitoring equipment. 675 */ 676#define DLT_GCOM_T1E1 172 677#define DLT_GCOM_SERIAL 173 678 679/* 680 * Juniper-private data link type, as per request from 681 * Hannes Gredler <hannes@juniper.net>. The DLT_ is used 682 * for internal communication to Physical Interface Cards (PIC) 683 */ 684#define DLT_JUNIPER_PIC_PEER 174 685 686/* 687 * Link types requested by Gregor Maier <gregor@endace.com> of Endace 688 * Measurement Systems. They add an ERF header (see 689 * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of 690 * the link-layer header. 691 */ 692#define DLT_ERF_ETH 175 /* Ethernet */ 693#define DLT_ERF_POS 176 /* Packet-over-SONET */ 694 695/* 696 * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD 697 * for vISDN (http://www.orlandi.com/visdn/). Its link-layer header 698 * includes additional information before the LAPD header, so it's 699 * not necessarily a generic LAPD header. 700 */ 701#define DLT_LINUX_LAPD 177 702 703/* 704 * Juniper-private data link type, as per request from 705 * Hannes Gredler <hannes@juniper.net>. 706 * The DLT_ are used for prepending meta-information 707 * like interface index, interface name 708 * before standard Ethernet, PPP, Frelay & C-HDLC Frames 709 */ 710#define DLT_JUNIPER_ETHER 178 711#define DLT_JUNIPER_PPP 179 712#define DLT_JUNIPER_FRELAY 180 713#define DLT_JUNIPER_CHDLC 181 714 715/* 716 * Multi Link Frame Relay (FRF.16) 717 */ 718#define DLT_MFR 182 719 720/* 721 * Juniper-private data link type, as per request from 722 * Hannes Gredler <hannes@juniper.net>. 723 * The DLT_ is used for internal communication with a 724 * voice Adapter Card (PIC) 725 */ 726#define DLT_JUNIPER_VP 183 727 728/* 729 * Arinc 429 frames. 730 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 731 * Every frame contains a 32bit A429 label. 732 * More documentation on Arinc 429 can be found at 733 * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf 734 */ 735#define DLT_A429 184 736 737/* 738 * Arinc 653 Interpartition Communication messages. 739 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 740 * Please refer to the A653-1 standard for more information. 741 */ 742#define DLT_A653_ICM 185 743 744/* 745 * USB packets, beginning with a USB setup header; requested by 746 * Paolo Abeni <paolo.abeni@email.it>. 747 */ 748#define DLT_USB 186 749 750/* 751 * Bluetooth HCI UART transport layer (part H:4); requested by 752 * Paolo Abeni. 753 */ 754#define DLT_BLUETOOTH_HCI_H4 187 755 756/* 757 * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz 758 * <cruz_petagay@bah.com>. 759 */ 760#define DLT_IEEE802_16_MAC_CPS 188 761 762/* 763 * USB packets, beginning with a Linux USB header; requested by 764 * Paolo Abeni <paolo.abeni@email.it>. 765 */ 766#define DLT_USB_LINUX 189 767 768/* 769 * Controller Area Network (CAN) v. 2.0B packets. 770 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 771 * Used to dump CAN packets coming from a CAN Vector board. 772 * More documentation on the CAN v2.0B frames can be found at 773 * http://www.can-cia.org/downloads/?269 774 */ 775#define DLT_CAN20B 190 776 777/* 778 * IEEE 802.15.4, with address fields padded, as is done by Linux 779 * drivers; requested by Juergen Schimmer. 780 */ 781#define DLT_IEEE802_15_4_LINUX 191 782 783/* 784 * Per Packet Information encapsulated packets. 785 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 786 */ 787#define DLT_PPI 192 788 789/* 790 * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header; 791 * requested by Charles Clancy. 792 */ 793#define DLT_IEEE802_16_MAC_CPS_RADIO 193 794 795/* 796 * Juniper-private data link type, as per request from 797 * Hannes Gredler <hannes@juniper.net>. 798 * The DLT_ is used for internal communication with a 799 * integrated service module (ISM). 800 */ 801#define DLT_JUNIPER_ISM 194 802 803/* 804 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 805 * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>. 806 */ 807#define DLT_IEEE802_15_4 195 808 809/* 810 * Various link-layer types, with a pseudo-header, for SITA 811 * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com). 812 */ 813#define DLT_SITA 196 814 815/* 816 * Various link-layer types, with a pseudo-header, for Endace DAG cards; 817 * encapsulates Endace ERF records. Requested by Stephen Donnelly 818 * <stephen@endace.com>. 819 */ 820#define DLT_ERF 197 821 822/* 823 * Special header prepended to Ethernet packets when capturing from a 824 * u10 Networks board. Requested by Phil Mulholland 825 * <phil@u10networks.com>. 826 */ 827#define DLT_RAIF1 198 828 829/* 830 * IPMB packet for IPMI, beginning with the I2C slave address, followed 831 * by the netFn and LUN, etc.. Requested by Chanthy Toeung 832 * <chanthy.toeung@ca.kontron.com>. 833 */ 834#define DLT_IPMB 199 835 836/* 837 * Juniper-private data link type, as per request from 838 * Hannes Gredler <hannes@juniper.net>. 839 * The DLT_ is used for capturing data on a secure tunnel interface. 840 */ 841#define DLT_JUNIPER_ST 200 842 843/* 844 * Bluetooth HCI UART transport layer (part H:4), with pseudo-header 845 * that includes direction information; requested by Paolo Abeni. 846 */ 847#define DLT_BLUETOOTH_HCI_H4_WITH_PHDR 201 848 849/* 850 * AX.25 packet with a 1-byte KISS header; see 851 * 852 * http://www.ax25.net/kiss.htm 853 * 854 * as per Richard Stearn <richard@rns-stearn.demon.co.uk>. 855 */ 856#define DLT_AX25_KISS 202 857 858/* 859 * LAPD packets from an ISDN channel, starting with the address field, 860 * with no pseudo-header. 861 * Requested by Varuna De Silva <varunax@gmail.com>. 862 */ 863#define DLT_LAPD 203 864 865/* 866 * Variants of various link-layer headers, with a one-byte direction 867 * pseudo-header prepended - zero means "received by this host", 868 * non-zero (any non-zero value) means "sent by this host" - as per 869 * Will Barker <w.barker@zen.co.uk>. 870 */ 871#define DLT_PPP_WITH_DIR 204 /* PPP - don't confuse with DLT_PPP_WITH_DIRECTION */ 872#define DLT_C_HDLC_WITH_DIR 205 /* Cisco HDLC */ 873#define DLT_FRELAY_WITH_DIR 206 /* Frame Relay */ 874#define DLT_LAPB_WITH_DIR 207 /* LAPB */ 875 876/* 877 * 208 is reserved for an as-yet-unspecified proprietary link-layer 878 * type, as requested by Will Barker. 879 */ 880 881/* 882 * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman 883 * <avn@pigeonpoint.com>. 884 */ 885#define DLT_IPMB_LINUX 209 886 887/* 888 * FlexRay automotive bus - http://www.flexray.com/ - as requested 889 * by Hannes Kaelber <hannes.kaelber@x2e.de>. 890 */ 891#define DLT_FLEXRAY 210 892 893/* 894 * Media Oriented Systems Transport (MOST) bus for multimedia 895 * transport - http://www.mostcooperation.com/ - as requested 896 * by Hannes Kaelber <hannes.kaelber@x2e.de>. 897 */ 898#define DLT_MOST 211 899 900/* 901 * Local Interconnect Network (LIN) bus for vehicle networks - 902 * http://www.lin-subbus.org/ - as requested by Hannes Kaelber 903 * <hannes.kaelber@x2e.de>. 904 */ 905#define DLT_LIN 212 906 907/* 908 * X2E-private data link type used for serial line capture, 909 * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>. 910 */ 911#define DLT_X2E_SERIAL 213 912 913/* 914 * X2E-private data link type used for the Xoraya data logger 915 * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>. 916 */ 917#define DLT_X2E_XORAYA 214 918 919/* 920 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 921 * nothing), but with the PHY-level data for non-ASK PHYs (4 octets 922 * of 0 as preamble, one octet of SFD, one octet of frame length+ 923 * reserved bit, and then the MAC-layer data, starting with the 924 * frame control field). 925 * 926 * Requested by Max Filippov <jcmvbkbc@gmail.com>. 927 */ 928#define DLT_IEEE802_15_4_NONASK_PHY 215 929 930/* 931 * David Gibson <david@gibson.dropbear.id.au> requested this for 932 * captures from the Linux kernel /dev/input/eventN devices. This 933 * is used to communicate keystrokes and mouse movements from the 934 * Linux kernel to display systems, such as Xorg. 935 */ 936#define DLT_LINUX_EVDEV 216 937 938/* 939 * GSM Um and Abis interfaces, preceded by a "gsmtap" header. 940 * 941 * Requested by Harald Welte <laforge@gnumonks.org>. 942 */ 943#define DLT_GSMTAP_UM 217 944#define DLT_GSMTAP_ABIS 218 945 946/* 947 * MPLS, with an MPLS label as the link-layer header. 948 * Requested by Michele Marchetto <michele@openbsd.org> on behalf 949 * of OpenBSD. 950 */ 951#define DLT_MPLS 219 952 953/* 954 * USB packets, beginning with a Linux USB header, with the USB header 955 * padded to 64 bytes; required for memory-mapped access. 956 */ 957#define DLT_USB_LINUX_MMAPPED 220 958 959/* 960 * DECT packets, with a pseudo-header; requested by 961 * Matthias Wenzel <tcpdump@mazzoo.de>. 962 */ 963#define DLT_DECT 221 964 965/* 966 * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov> 967 * Date: Mon, 11 May 2009 11:18:30 -0500 968 * 969 * DLT_AOS. We need it for AOS Space Data Link Protocol. 970 * I have already written dissectors for but need an OK from 971 * legal before I can submit a patch. 972 * 973 */ 974#define DLT_AOS 222 975 976/* 977 * Wireless HART (Highway Addressable Remote Transducer) 978 * From the HART Communication Foundation 979 * IES/PAS 62591 980 * 981 * Requested by Sam Roberts <vieuxtech@gmail.com>. 982 */ 983#define DLT_WIHART 223 984 985/* 986 * Fibre Channel FC-2 frames, beginning with a Frame_Header. 987 * Requested by Kahou Lei <kahou82@gmail.com>. 988 */ 989#define DLT_FC_2 224 990 991/* 992 * Fibre Channel FC-2 frames, beginning with an encoding of the 993 * SOF, and ending with an encoding of the EOF. 994 * 995 * The encodings represent the frame delimiters as 4-byte sequences 996 * representing the corresponding ordered sets, with K28.5 997 * represented as 0xBC, and the D symbols as the corresponding 998 * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2, 999 * is represented as 0xBC 0xB5 0x55 0x55. 1000 * 1001 * Requested by Kahou Lei <kahou82@gmail.com>. 1002 */ 1003#define DLT_FC_2_WITH_FRAME_DELIMS 225 1004 1005/* 1006 * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>. 1007 * 1008 * The pseudo-header starts with a one-byte version number; for version 2, 1009 * the pseudo-header is: 1010 * 1011 * struct dl_ipnetinfo { 1012 * u_int8_t dli_version; 1013 * u_int8_t dli_family; 1014 * u_int16_t dli_htype; 1015 * u_int32_t dli_pktlen; 1016 * u_int32_t dli_ifindex; 1017 * u_int32_t dli_grifindex; 1018 * u_int32_t dli_zsrc; 1019 * u_int32_t dli_zdst; 1020 * }; 1021 * 1022 * dli_version is 2 for the current version of the pseudo-header. 1023 * 1024 * dli_family is a Solaris address family value, so it's 2 for IPv4 1025 * and 26 for IPv6. 1026 * 1027 * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing 1028 * packets, and 2 for packets arriving from another zone on the same 1029 * machine. 1030 * 1031 * dli_pktlen is the length of the packet data following the pseudo-header 1032 * (so the captured length minus dli_pktlen is the length of the 1033 * pseudo-header, assuming the entire pseudo-header was captured). 1034 * 1035 * dli_ifindex is the interface index of the interface on which the 1036 * packet arrived. 1037 * 1038 * dli_grifindex is the group interface index number (for IPMP interfaces). 1039 * 1040 * dli_zsrc is the zone identifier for the source of the packet. 1041 * 1042 * dli_zdst is the zone identifier for the destination of the packet. 1043 * 1044 * A zone number of 0 is the global zone; a zone number of 0xffffffff 1045 * means that the packet arrived from another host on the network, not 1046 * from another zone on the same machine. 1047 * 1048 * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates 1049 * which of those it is. 1050 */ 1051#define DLT_IPNET 226 1052 1053/* 1054 * CAN (Controller Area Network) frames, with a pseudo-header as supplied 1055 * by Linux SocketCAN. See Documentation/networking/can.txt in the Linux 1056 * source. 1057 * 1058 * Requested by Felix Obenhuber <felix@obenhuber.de>. 1059 */ 1060#define DLT_CAN_SOCKETCAN 227 1061 1062/* 1063 * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies 1064 * whether it's v4 or v6. Requested by Darren Reed <Darren.Reed@Sun.COM>. 1065 */ 1066#define DLT_IPV4 228 1067#define DLT_IPV6 229 1068 1069/* 1070 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 1071 * nothing), and with no FCS at the end of the frame; requested by 1072 * Jon Smirl <jonsmirl@gmail.com>. 1073 */ 1074#define DLT_IEEE802_15_4_NOFCS 230 1075 1076/* 1077 * Raw D-Bus: 1078 * 1079 * http://www.freedesktop.org/wiki/Software/dbus 1080 * 1081 * messages: 1082 * 1083 * http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages 1084 * 1085 * starting with the endianness flag, followed by the message type, etc., 1086 * but without the authentication handshake before the message sequence: 1087 * 1088 * http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol 1089 * 1090 * Requested by Martin Vidner <martin@vidner.net>. 1091 */ 1092#define DLT_DBUS 231 1093 1094/* 1095 * Juniper-private data link type, as per request from 1096 * Hannes Gredler <hannes@juniper.net>. 1097 */ 1098#define DLT_JUNIPER_VS 232 1099#define DLT_JUNIPER_SRX_E2E 233 1100#define DLT_JUNIPER_FIBRECHANNEL 234 1101 1102/* 1103 * DVB-CI (DVB Common Interface for communication between a PC Card 1104 * module and a DVB receiver). See 1105 * 1106 * http://www.kaiser.cx/pcap-dvbci.html 1107 * 1108 * for the specification. 1109 * 1110 * Requested by Martin Kaiser <martin@kaiser.cx>. 1111 */ 1112#define DLT_DVB_CI 235 1113 1114/* 1115 * Variant of 3GPP TS 27.010 multiplexing protocol (similar to, but 1116 * *not* the same as, 27.010). Requested by Hans-Christoph Schemmel 1117 * <hans-christoph.schemmel@cinterion.com>. 1118 */ 1119#define DLT_MUX27010 236 1120 1121/* 1122 * STANAG 5066 D_PDUs. Requested by M. Baris Demiray 1123 * <barisdemiray@gmail.com>. 1124 */ 1125#define DLT_STANAG_5066_D_PDU 237 1126 1127/* 1128 * Juniper-private data link type, as per request from 1129 * Hannes Gredler <hannes@juniper.net>. 1130 */ 1131#define DLT_JUNIPER_ATM_CEMIC 238 1132 1133/* 1134 * NetFilter LOG messages 1135 * (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets) 1136 * 1137 * Requested by Jakub Zawadzki <darkjames-ws@darkjames.pl> 1138 */ 1139#define DLT_NFLOG 239 1140 1141/* 1142 * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type 1143 * for Ethernet packets with a 4-byte pseudo-header and always 1144 * with the payload including the FCS, as supplied by their 1145 * netANALYZER hardware and software. 1146 * 1147 * Requested by Holger P. Frommer <HPfrommer@hilscher.com> 1148 */ 1149#define DLT_NETANALYZER 240 1150 1151/* 1152 * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type 1153 * for Ethernet packets with a 4-byte pseudo-header and FCS and 1154 * with the Ethernet header preceded by 7 bytes of preamble and 1155 * 1 byte of SFD, as supplied by their netANALYZER hardware and 1156 * software. 1157 * 1158 * Requested by Holger P. Frommer <HPfrommer@hilscher.com> 1159 */ 1160#define DLT_NETANALYZER_TRANSPARENT 241 1161 1162/* 1163 * IP-over-Infiniband, as specified by RFC 4391. 1164 * 1165 * Requested by Petr Sumbera <petr.sumbera@oracle.com>. 1166 */ 1167#define DLT_IPOIB 242 1168 1169/* 1170 * MPEG-2 transport stream (ISO 13818-1/ITU-T H.222.0). 1171 * 1172 * Requested by Guy Martin <gmsoft@tuxicoman.be>. 1173 */ 1174#define DLT_MPEG_2_TS 243 1175 1176/* 1177 * ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as 1178 * used by their ng40 protocol tester. 1179 * 1180 * Requested by Jens Grimmer <jens.grimmer@ng4t.com>. 1181 */ 1182#define DLT_NG40 244 1183 1184/* 1185 * Pseudo-header giving adapter number and flags, followed by an NFC 1186 * (Near-Field Communications) Logical Link Control Protocol (LLCP) PDU, 1187 * as specified by NFC Forum Logical Link Control Protocol Technical 1188 * Specification LLCP 1.1. 1189 * 1190 * Requested by Mike Wakerly <mikey@google.com>. 1191 */ 1192#define DLT_NFC_LLCP 245 1193 1194 1195#define DLT_MATCHING_MAX 245 /* highest value in the "matching" range */ 1196 1197/* 1198 * The instruction encodings. 1199 */ 1200/* instruction classes */ 1201#define BPF_CLASS(code) ((code) & 0x07) 1202#define BPF_LD 0x00 1203#define BPF_LDX 0x01 1204#define BPF_ST 0x02 1205#define BPF_STX 0x03 1206#define BPF_ALU 0x04 1207#define BPF_JMP 0x05 1208#define BPF_RET 0x06 1209#define BPF_MISC 0x07 1210 1211/* ld/ldx fields */ 1212#define BPF_SIZE(code) ((code) & 0x18) 1213#define BPF_W 0x00 1214#define BPF_H 0x08 1215#define BPF_B 0x10 1216#define BPF_MODE(code) ((code) & 0xe0) 1217#define BPF_IMM 0x00 1218#define BPF_ABS 0x20 1219#define BPF_IND 0x40 1220#define BPF_MEM 0x60 1221#define BPF_LEN 0x80 1222#define BPF_MSH 0xa0 1223 1224/* alu/jmp fields */ 1225#define BPF_OP(code) ((code) & 0xf0) 1226#define BPF_ADD 0x00 1227#define BPF_SUB 0x10 1228#define BPF_MUL 0x20 1229#define BPF_DIV 0x30 1230#define BPF_OR 0x40 1231#define BPF_AND 0x50 1232#define BPF_LSH 0x60 1233#define BPF_RSH 0x70 1234#define BPF_NEG 0x80 1235#define BPF_JA 0x00 1236#define BPF_JEQ 0x10 1237#define BPF_JGT 0x20 1238#define BPF_JGE 0x30 1239#define BPF_JSET 0x40 1240#define BPF_SRC(code) ((code) & 0x08) 1241#define BPF_K 0x00 1242#define BPF_X 0x08 1243 1244/* ret - BPF_K and BPF_X also apply */ 1245#define BPF_RVAL(code) ((code) & 0x18) 1246#define BPF_A 0x10 1247 1248/* misc */ 1249#define BPF_MISCOP(code) ((code) & 0xf8) 1250#define BPF_TAX 0x00 1251#define BPF_TXA 0x80 1252 1253/* 1254 * The instruction data structure. 1255 */ 1256struct bpf_insn { 1257 u_short code; 1258 u_char jt; 1259 u_char jf; 1260 bpf_u_int32 k; 1261}; 1262 1263/* 1264 * Macros for insn array initializers. 1265 */ 1266#define BPF_STMT(code, k) { (u_short)(code), 0, 0, k } 1267#define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k } 1268 1269#pragma pack(4) 1270 1271/* 1272 * Structure to retrieve available DLTs for the interface. 1273 */ 1274struct bpf_dltlist { 1275 u_int32_t bfl_len; /* number of bfd_list array */ 1276 union { 1277 u_int32_t *bflu_list; /* array of DLTs */ 1278 u_int64_t bflu_pad; 1279 } bfl_u; 1280}; 1281#define bfl_list bfl_u.bflu_list 1282 1283#pragma pack() 1284 1285#ifdef KERNEL_PRIVATE 1286/* Forward declerations */ 1287struct ifnet; 1288struct mbuf; 1289 1290extern int bpf_validate(const struct bpf_insn *, int); 1291extern void bpfdetach(struct ifnet *); 1292extern void bpfilterattach(int); 1293extern u_int bpf_filter(const struct bpf_insn *, u_char *, u_int, u_int); 1294#endif /* KERNEL_PRIVATE */ 1295 1296#ifdef KERNEL 1297#ifndef BPF_TAP_MODE_T 1298#define BPF_TAP_MODE_T 1299/*! 1300 @enum BPF tap mode 1301 @abstract Constants defining interface families. 1302 @constant BPF_MODE_DISABLED Disable bpf. 1303 @constant BPF_MODE_INPUT Enable input only. 1304 @constant BPF_MODE_OUTPUT Enable output only. 1305 @constant BPF_MODE_INPUT_OUTPUT Enable input and output. 1306*/ 1307 1308enum { 1309 BPF_MODE_DISABLED = 0, 1310 BPF_MODE_INPUT = 1, 1311 BPF_MODE_OUTPUT = 2, 1312 BPF_MODE_INPUT_OUTPUT = 3 1313}; 1314/*! 1315 @typedef bpf_tap_mode 1316 @abstract Mode for tapping. BPF_MODE_DISABLED/BPF_MODE_INPUT_OUTPUT etc. 1317*/ 1318typedef u_int32_t bpf_tap_mode; 1319#endif /* !BPF_TAP_MODE_T */ 1320 1321/*! 1322 @typedef bpf_send_func 1323 @discussion bpf_send_func is called when a bpf file descriptor is 1324 used to send a raw packet on the interface. The mbuf and data 1325 link type are specified. The callback is responsible for 1326 releasing the mbuf whether or not it returns an error. 1327 @param interface The interface the packet is being sent on. 1328 @param dlt The data link type the bpf device is attached to. 1329 @param packet The packet to be sent. 1330 */ 1331typedef errno_t (*bpf_send_func)(ifnet_t interface, u_int32_t data_link_type, 1332 mbuf_t packet); 1333 1334/*! 1335 @typedef bpf_tap_func 1336 @discussion bpf_tap_func is called when the tap state of the 1337 interface changes. This happens when a bpf device attaches to an 1338 interface or detaches from an interface. The tap mode will join 1339 together (bit or) the modes of all bpf devices using that 1340 interface for that dlt. If you return an error from this 1341 function, the bpf device attach attempt that triggered the tap 1342 will fail. If this function was called bacuse the tap state was 1343 decreasing (tap in or out is stopping), the error will be 1344 ignored. 1345 @param interface The interface being tapped. 1346 @param dlt The data link type being tapped. 1347 @param direction The direction of the tap. 1348 */ 1349typedef errno_t (*bpf_tap_func)(ifnet_t interface, u_int32_t data_link_type, 1350 bpf_tap_mode direction); 1351 1352/*! 1353 @function bpfattach 1354 @discussion Registers an interface with BPF. This allows bpf devices 1355 to attach to your interface to capture packets. Your interface 1356 will be unregistered automatically when your interface is 1357 detached. 1358 @param interface The interface to register with BPF. 1359 @param data_link_type The data link type of the interface. See the 1360 DLT_* defines in bpf.h. 1361 @param header_length The length, in bytes, of the data link header. 1362 */ 1363extern void bpfattach(ifnet_t interface, u_int data_link_type, 1364 u_int header_length); 1365 1366/*! 1367 @function bpf_attach 1368 @discussion Registers an interface with BPF. This allows bpf devices 1369 to attach to your interface to capture and transmit packets. 1370 Your interface will be unregistered automatically when your 1371 interface is detached. You may register multiple times with 1372 different data link types. An 802.11 interface would use this to 1373 allow clients to pick whether they want just an ethernet style 1374 frame or the 802.11 wireless headers as well. The first dlt you 1375 register will be considered the default. Any bpf device attaches 1376 that do not specify a data link type will use the default. 1377 @param interface The interface to register with BPF. 1378 @param data_link_type The data link type of the interface. See the 1379 DLT_* defines in bpf.h. 1380 @param header_length The length, in bytes, of the data link header. 1381 @param send See the bpf_send_func described above. 1382 @param tap See the bpf_tap_func described above. 1383 */ 1384extern errno_t bpf_attach(ifnet_t interface, u_int32_t data_link_type, 1385 u_int32_t header_length, bpf_send_func send, bpf_tap_func tap); 1386 1387/*! 1388 @function bpf_tap_in 1389 @discussion Call this function when your interface receives a 1390 packet. This function will check if any bpf devices need a 1391 a copy of the packet. 1392 @param interface The interface the packet was received on. 1393 @param dlt The data link type of the packet. 1394 @param packet The packet received. 1395 @param header An optional pointer to a header that will be prepended. 1396 @param headerlen If the header was specified, the length of the header. 1397 */ 1398extern void bpf_tap_in(ifnet_t interface, u_int32_t dlt, mbuf_t packet, 1399 void *header, size_t header_len); 1400 1401/*! 1402 @function bpf_tap_out 1403 @discussion Call this function when your interface trasmits a 1404 packet. This function will check if any bpf devices need a 1405 a copy of the packet. 1406 @param interface The interface the packet was or will be transmitted on. 1407 @param dlt The data link type of the packet. 1408 @param packet The packet received. 1409 @param header An optional pointer to a header that will be prepended. 1410 @param headerlen If the header was specified, the length of the header. 1411 */ 1412extern void bpf_tap_out(ifnet_t interface, u_int32_t dlt, mbuf_t packet, 1413 void *header, size_t header_len); 1414 1415#endif /* KERNEL */ 1416 1417/* 1418 * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST). 1419 */ 1420#define BPF_MEMWORDS 16 1421 1422#endif /* _NET_BPF_H_ */ 1423