1214455Srpaulo/* 2214455Srpaulo * Copyright (c) 1993, 1994, 1995, 1996, 1997 3214455Srpaulo * The Regents of the University of California. All rights reserved. 4214455Srpaulo * 5214455Srpaulo * Redistribution and use in source and binary forms, with or without 6214455Srpaulo * modification, are permitted provided that: (1) source code distributions 7214455Srpaulo * retain the above copyright notice and this paragraph in its entirety, (2) 8214455Srpaulo * distributions including binary code include the above copyright notice and 9214455Srpaulo * this paragraph in its entirety in the documentation or other materials 10214455Srpaulo * provided with the distribution, and (3) all advertising materials mentioning 11214455Srpaulo * features or use of this software display the following acknowledgement: 12214455Srpaulo * ``This product includes software developed by the University of California, 13214455Srpaulo * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14214455Srpaulo * the University nor the names of its contributors may be used to endorse 15214455Srpaulo * or promote products derived from this software without specific prior 16214455Srpaulo * written permission. 17214455Srpaulo * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18214455Srpaulo * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19214455Srpaulo * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20214455Srpaulo * 21235426Sdelphij * pcap-common.c - common code for pcap and pcap-ng files 22214455Srpaulo */ 23214455Srpaulo 24214455Srpaulo#ifdef HAVE_CONFIG_H 25214455Srpaulo#include "config.h" 26214455Srpaulo#endif 27214455Srpaulo 28214455Srpaulo#ifdef WIN32 29214455Srpaulo#include <pcap-stdinc.h> 30214455Srpaulo#else /* WIN32 */ 31214455Srpaulo#if HAVE_INTTYPES_H 32214455Srpaulo#include <inttypes.h> 33214455Srpaulo#elif HAVE_STDINT_H 34214455Srpaulo#include <stdint.h> 35214455Srpaulo#endif 36214455Srpaulo#ifdef HAVE_SYS_BITYPES_H 37214455Srpaulo#include <sys/bitypes.h> 38214455Srpaulo#endif 39214455Srpaulo#include <sys/types.h> 40214455Srpaulo#endif /* WIN32 */ 41214455Srpaulo 42214455Srpaulo#include "pcap-int.h" 43214455Srpaulo#include "pcap/usb.h" 44214455Srpaulo 45214455Srpaulo#include "pcap-common.h" 46214455Srpaulo 47214455Srpaulo/* 48214455Srpaulo * We don't write DLT_* values to capture files, because they're not the 49214455Srpaulo * same on all platforms. 50214455Srpaulo * 51214455Srpaulo * Unfortunately, the various flavors of BSD have not always used the same 52214455Srpaulo * numerical values for the same data types, and various patches to 53214455Srpaulo * libpcap for non-BSD OSes have added their own DLT_* codes for link 54214455Srpaulo * layer encapsulation types seen on those OSes, and those codes have had, 55214455Srpaulo * in some cases, values that were also used, on other platforms, for other 56214455Srpaulo * link layer encapsulation types. 57214455Srpaulo * 58214455Srpaulo * This means that capture files of a type whose numerical DLT_* code 59214455Srpaulo * means different things on different BSDs, or with different versions 60214455Srpaulo * of libpcap, can't always be read on systems other than those like 61214455Srpaulo * the one running on the machine on which the capture was made. 62214455Srpaulo * 63214455Srpaulo * Instead, we define here a set of LINKTYPE_* codes, and map DLT_* codes 64214455Srpaulo * to LINKTYPE_* codes when writing a savefile header, and map LINKTYPE_* 65214455Srpaulo * codes to DLT_* codes when reading a savefile header. 66214455Srpaulo * 67214455Srpaulo * For those DLT_* codes that have, as far as we know, the same values on 68214455Srpaulo * all platforms (DLT_NULL through DLT_FDDI), we define LINKTYPE_xxx as 69214455Srpaulo * DLT_xxx; that way, captures of those types can still be read by 70214455Srpaulo * versions of libpcap that map LINKTYPE_* values to DLT_* values, and 71214455Srpaulo * captures of those types written by versions of libpcap that map DLT_ 72214455Srpaulo * values to LINKTYPE_ values can still be read by older versions 73214455Srpaulo * of libpcap. 74214455Srpaulo * 75214455Srpaulo * The other LINKTYPE_* codes are given values starting at 100, in the 76214455Srpaulo * hopes that no DLT_* code will be given one of those values. 77214455Srpaulo * 78214455Srpaulo * In order to ensure that a given LINKTYPE_* code's value will refer to 79214455Srpaulo * the same encapsulation type on all platforms, you should not allocate 80214455Srpaulo * a new LINKTYPE_* value without consulting 81214455Srpaulo * "tcpdump-workers@lists.tcpdump.org". The tcpdump developers will 82214455Srpaulo * allocate a value for you, and will not subsequently allocate it to 83214455Srpaulo * anybody else; that value will be added to the "pcap.h" in the 84214455Srpaulo * tcpdump.org Git repository, so that a future libpcap release will 85214455Srpaulo * include it. 86214455Srpaulo * 87214455Srpaulo * You should, if possible, also contribute patches to libpcap and tcpdump 88214455Srpaulo * to handle the new encapsulation type, so that they can also be checked 89214455Srpaulo * into the tcpdump.org Git repository and so that they will appear in 90214455Srpaulo * future libpcap and tcpdump releases. 91214455Srpaulo * 92214455Srpaulo * Do *NOT* assume that any values after the largest value in this file 93214455Srpaulo * are available; you might not have the most up-to-date version of this 94214455Srpaulo * file, and new values after that one might have been assigned. Also, 95214455Srpaulo * do *NOT* use any values below 100 - those might already have been 96214455Srpaulo * taken by one (or more!) organizations. 97235426Sdelphij * 98235426Sdelphij * Any platform that defines additional DLT_* codes should: 99235426Sdelphij * 100235426Sdelphij * request a LINKTYPE_* code and value from tcpdump.org, 101235426Sdelphij * as per the above; 102235426Sdelphij * 103235426Sdelphij * add, in their version of libpcap, an entry to map 104235426Sdelphij * those DLT_* codes to the corresponding LINKTYPE_* 105235426Sdelphij * code; 106235426Sdelphij * 107235426Sdelphij * redefine, in their "net/bpf.h", any DLT_* values 108235426Sdelphij * that collide with the values used by their additional 109235426Sdelphij * DLT_* codes, to remove those collisions (but without 110235426Sdelphij * making them collide with any of the LINKTYPE_* 111235426Sdelphij * values equal to 50 or above; they should also avoid 112235426Sdelphij * defining DLT_* values that collide with those 113235426Sdelphij * LINKTYPE_* values, either). 114214455Srpaulo */ 115214455Srpaulo#define LINKTYPE_NULL DLT_NULL 116214455Srpaulo#define LINKTYPE_ETHERNET DLT_EN10MB /* also for 100Mb and up */ 117214455Srpaulo#define LINKTYPE_EXP_ETHERNET DLT_EN3MB /* 3Mb experimental Ethernet */ 118214455Srpaulo#define LINKTYPE_AX25 DLT_AX25 119214455Srpaulo#define LINKTYPE_PRONET DLT_PRONET 120214455Srpaulo#define LINKTYPE_CHAOS DLT_CHAOS 121241231Sdelphij#define LINKTYPE_IEEE802_5 DLT_IEEE802 /* DLT_IEEE802 is used for 802.5 Token Ring */ 122235426Sdelphij#define LINKTYPE_ARCNET_BSD DLT_ARCNET /* BSD-style headers */ 123214455Srpaulo#define LINKTYPE_SLIP DLT_SLIP 124214455Srpaulo#define LINKTYPE_PPP DLT_PPP 125214455Srpaulo#define LINKTYPE_FDDI DLT_FDDI 126214455Srpaulo 127214455Srpaulo/* 128214455Srpaulo * LINKTYPE_PPP is for use when there might, or might not, be an RFC 1662 129214455Srpaulo * PPP in HDLC-like framing header (with 0xff 0x03 before the PPP protocol 130214455Srpaulo * field) at the beginning of the packet. 131214455Srpaulo * 132214455Srpaulo * This is for use when there is always such a header; the address field 133214455Srpaulo * might be 0xff, for regular PPP, or it might be an address field for Cisco 134214455Srpaulo * point-to-point with HDLC framing as per section 4.3.1 of RFC 1547 ("Cisco 135214455Srpaulo * HDLC"). This is, for example, what you get with NetBSD's DLT_PPP_SERIAL. 136214455Srpaulo * 137214455Srpaulo * We give it the same value as NetBSD's DLT_PPP_SERIAL, in the hopes that 138214455Srpaulo * nobody else will choose a DLT_ value of 50, and so that DLT_PPP_SERIAL 139214455Srpaulo * captures will be written out with a link type that NetBSD's tcpdump 140214455Srpaulo * can read. 141214455Srpaulo */ 142214455Srpaulo#define LINKTYPE_PPP_HDLC 50 /* PPP in HDLC-like framing */ 143214455Srpaulo 144214455Srpaulo#define LINKTYPE_PPP_ETHER 51 /* NetBSD PPP-over-Ethernet */ 145214455Srpaulo 146214455Srpaulo#define LINKTYPE_SYMANTEC_FIREWALL 99 /* Symantec Enterprise Firewall */ 147214455Srpaulo 148235426Sdelphij/* 149235426Sdelphij * These correspond to DLT_s that have different values on different 150235426Sdelphij * platforms; we map between these values in capture files and 151235426Sdelphij * the DLT_ values as returned by pcap_datalink() and passed to 152235426Sdelphij * pcap_open_dead(). 153235426Sdelphij */ 154214455Srpaulo#define LINKTYPE_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */ 155214455Srpaulo#define LINKTYPE_RAW 101 /* raw IP */ 156214455Srpaulo#define LINKTYPE_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */ 157214455Srpaulo#define LINKTYPE_PPP_BSDOS 103 /* BSD/OS PPP BPF header */ 158235426Sdelphij 159235426Sdelphij/* 160235426Sdelphij * Values starting with 104 are used for newly-assigned link-layer 161235426Sdelphij * header type values; for those link-layer header types, the DLT_ 162235426Sdelphij * value returned by pcap_datalink() and passed to pcap_open_dead(), 163235426Sdelphij * and the LINKTYPE_ value that appears in capture files, are the 164235426Sdelphij * same. 165235426Sdelphij * 166235426Sdelphij * LINKTYPE_MATCHING_MIN is the lowest such value; LINKTYPE_MATCHING_MAX 167235426Sdelphij * is the highest such value. 168235426Sdelphij */ 169235426Sdelphij#define LINKTYPE_MATCHING_MIN 104 /* lowest value in the "matching" range */ 170235426Sdelphij 171214455Srpaulo#define LINKTYPE_C_HDLC 104 /* Cisco HDLC */ 172214455Srpaulo#define LINKTYPE_IEEE802_11 105 /* IEEE 802.11 (wireless) */ 173214455Srpaulo#define LINKTYPE_ATM_CLIP 106 /* Linux Classical IP over ATM */ 174214455Srpaulo#define LINKTYPE_FRELAY 107 /* Frame Relay */ 175214455Srpaulo#define LINKTYPE_LOOP 108 /* OpenBSD loopback */ 176214455Srpaulo#define LINKTYPE_ENC 109 /* OpenBSD IPSEC enc */ 177214455Srpaulo 178214455Srpaulo/* 179214455Srpaulo * These three types are reserved for future use. 180214455Srpaulo */ 181214455Srpaulo#define LINKTYPE_LANE8023 110 /* ATM LANE + 802.3 */ 182214455Srpaulo#define LINKTYPE_HIPPI 111 /* NetBSD HIPPI */ 183214455Srpaulo#define LINKTYPE_HDLC 112 /* NetBSD HDLC framing */ 184214455Srpaulo 185214455Srpaulo#define LINKTYPE_LINUX_SLL 113 /* Linux cooked socket capture */ 186214455Srpaulo#define LINKTYPE_LTALK 114 /* Apple LocalTalk hardware */ 187214455Srpaulo#define LINKTYPE_ECONET 115 /* Acorn Econet */ 188214455Srpaulo 189214455Srpaulo/* 190214455Srpaulo * Reserved for use with OpenBSD ipfilter. 191214455Srpaulo */ 192214455Srpaulo#define LINKTYPE_IPFILTER 116 193214455Srpaulo 194214455Srpaulo#define LINKTYPE_PFLOG 117 /* OpenBSD DLT_PFLOG */ 195214455Srpaulo#define LINKTYPE_CISCO_IOS 118 /* For Cisco-internal use */ 196241231Sdelphij#define LINKTYPE_IEEE802_11_PRISM 119 /* 802.11 plus Prism II monitor mode radio metadata header */ 197241231Sdelphij#define LINKTYPE_IEEE802_11_AIRONET 120 /* 802.11 plus FreeBSD Aironet driver radio metadata header */ 198214455Srpaulo 199214455Srpaulo/* 200214455Srpaulo * Reserved for Siemens HiPath HDLC. 201214455Srpaulo */ 202214455Srpaulo#define LINKTYPE_HHDLC 121 203214455Srpaulo 204214455Srpaulo#define LINKTYPE_IP_OVER_FC 122 /* RFC 2625 IP-over-Fibre Channel */ 205214455Srpaulo#define LINKTYPE_SUNATM 123 /* Solaris+SunATM */ 206214455Srpaulo 207214455Srpaulo/* 208214455Srpaulo * Reserved as per request from Kent Dahlgren <kent@praesum.com> 209214455Srpaulo * for private use. 210214455Srpaulo */ 211214455Srpaulo#define LINKTYPE_RIO 124 /* RapidIO */ 212214455Srpaulo#define LINKTYPE_PCI_EXP 125 /* PCI Express */ 213214455Srpaulo#define LINKTYPE_AURORA 126 /* Xilinx Aurora link layer */ 214214455Srpaulo 215241231Sdelphij#define LINKTYPE_IEEE802_11_RADIOTAP 127 /* 802.11 plus radiotap radio metadata header */ 216214455Srpaulo 217214455Srpaulo/* 218214455Srpaulo * Reserved for the TZSP encapsulation, as per request from 219214455Srpaulo * Chris Waters <chris.waters@networkchemistry.com> 220214455Srpaulo * TZSP is a generic encapsulation for any other link type, 221214455Srpaulo * which includes a means to include meta-information 222214455Srpaulo * with the packet, e.g. signal strength and channel 223214455Srpaulo * for 802.11 packets. 224214455Srpaulo */ 225214455Srpaulo#define LINKTYPE_TZSP 128 /* Tazmen Sniffer Protocol */ 226214455Srpaulo 227214455Srpaulo#define LINKTYPE_ARCNET_LINUX 129 /* Linux-style headers */ 228214455Srpaulo 229214455Srpaulo/* 230214455Srpaulo * Juniper-private data link types, as per request from 231214455Srpaulo * Hannes Gredler <hannes@juniper.net>. The corresponding 232214455Srpaulo * DLT_s are used for passing on chassis-internal 233214455Srpaulo * metainformation such as QOS profiles, etc.. 234214455Srpaulo */ 235214455Srpaulo#define LINKTYPE_JUNIPER_MLPPP 130 236214455Srpaulo#define LINKTYPE_JUNIPER_MLFR 131 237214455Srpaulo#define LINKTYPE_JUNIPER_ES 132 238214455Srpaulo#define LINKTYPE_JUNIPER_GGSN 133 239214455Srpaulo#define LINKTYPE_JUNIPER_MFR 134 240214455Srpaulo#define LINKTYPE_JUNIPER_ATM2 135 241214455Srpaulo#define LINKTYPE_JUNIPER_SERVICES 136 242214455Srpaulo#define LINKTYPE_JUNIPER_ATM1 137 243214455Srpaulo 244214455Srpaulo#define LINKTYPE_APPLE_IP_OVER_IEEE1394 138 /* Apple IP-over-IEEE 1394 cooked header */ 245214455Srpaulo 246214455Srpaulo#define LINKTYPE_MTP2_WITH_PHDR 139 247214455Srpaulo#define LINKTYPE_MTP2 140 248214455Srpaulo#define LINKTYPE_MTP3 141 249214455Srpaulo#define LINKTYPE_SCCP 142 250214455Srpaulo 251214455Srpaulo#define LINKTYPE_DOCSIS 143 /* DOCSIS MAC frames */ 252214455Srpaulo 253214455Srpaulo#define LINKTYPE_LINUX_IRDA 144 /* Linux-IrDA */ 254214455Srpaulo 255214455Srpaulo/* 256214455Srpaulo * Reserved for IBM SP switch and IBM Next Federation switch. 257214455Srpaulo */ 258214455Srpaulo#define LINKTYPE_IBM_SP 145 259214455Srpaulo#define LINKTYPE_IBM_SN 146 260214455Srpaulo 261214455Srpaulo/* 262214455Srpaulo * Reserved for private use. If you have some link-layer header type 263214455Srpaulo * that you want to use within your organization, with the capture files 264214455Srpaulo * using that link-layer header type not ever be sent outside your 265214455Srpaulo * organization, you can use these values. 266214455Srpaulo * 267214455Srpaulo * No libpcap release will use these for any purpose, nor will any 268214455Srpaulo * tcpdump release use them, either. 269214455Srpaulo * 270214455Srpaulo * Do *NOT* use these in capture files that you expect anybody not using 271214455Srpaulo * your private versions of capture-file-reading tools to read; in 272214455Srpaulo * particular, do *NOT* use them in products, otherwise you may find that 273214455Srpaulo * people won't be able to use tcpdump, or snort, or Ethereal, or... to 274214455Srpaulo * read capture files from your firewall/intrusion detection/traffic 275214455Srpaulo * monitoring/etc. appliance, or whatever product uses that LINKTYPE_ value, 276214455Srpaulo * and you may also find that the developers of those applications will 277214455Srpaulo * not accept patches to let them read those files. 278214455Srpaulo * 279214455Srpaulo * Also, do not use them if somebody might send you a capture using them 280214455Srpaulo * for *their* private type and tools using them for *your* private type 281214455Srpaulo * would have to read them. 282214455Srpaulo * 283214455Srpaulo * Instead, in those cases, ask "tcpdump-workers@lists.tcpdump.org" for a 284214455Srpaulo * new DLT_ and LINKTYPE_ value, as per the comment in pcap/bpf.h, and use 285214455Srpaulo * the type you're given. 286214455Srpaulo */ 287214455Srpaulo#define LINKTYPE_USER0 147 288214455Srpaulo#define LINKTYPE_USER1 148 289214455Srpaulo#define LINKTYPE_USER2 149 290214455Srpaulo#define LINKTYPE_USER3 150 291214455Srpaulo#define LINKTYPE_USER4 151 292214455Srpaulo#define LINKTYPE_USER5 152 293214455Srpaulo#define LINKTYPE_USER6 153 294214455Srpaulo#define LINKTYPE_USER7 154 295214455Srpaulo#define LINKTYPE_USER8 155 296214455Srpaulo#define LINKTYPE_USER9 156 297214455Srpaulo#define LINKTYPE_USER10 157 298214455Srpaulo#define LINKTYPE_USER11 158 299214455Srpaulo#define LINKTYPE_USER12 159 300214455Srpaulo#define LINKTYPE_USER13 160 301214455Srpaulo#define LINKTYPE_USER14 161 302214455Srpaulo#define LINKTYPE_USER15 162 303214455Srpaulo 304214455Srpaulo/* 305214455Srpaulo * For future use with 802.11 captures - defined by AbsoluteValue 306214455Srpaulo * Systems to store a number of bits of link-layer information 307214455Srpaulo * including radio information: 308214455Srpaulo * 309214455Srpaulo * http://www.shaftnet.org/~pizza/software/capturefrm.txt 310214455Srpaulo */ 311241231Sdelphij#define LINKTYPE_IEEE802_11_AVS 163 /* 802.11 plus AVS radio metadata header */ 312214455Srpaulo 313214455Srpaulo/* 314214455Srpaulo * Juniper-private data link type, as per request from 315214455Srpaulo * Hannes Gredler <hannes@juniper.net>. The corresponding 316214455Srpaulo * DLT_s are used for passing on chassis-internal 317214455Srpaulo * metainformation such as QOS profiles, etc.. 318214455Srpaulo */ 319214455Srpaulo#define LINKTYPE_JUNIPER_MONITOR 164 320214455Srpaulo 321214455Srpaulo/* 322241231Sdelphij * BACnet MS/TP frames. 323214455Srpaulo */ 324214455Srpaulo#define LINKTYPE_BACNET_MS_TP 165 325214455Srpaulo 326214455Srpaulo/* 327214455Srpaulo * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>. 328214455Srpaulo * 329214455Srpaulo * This is used in some OSes to allow a kernel socket filter to distinguish 330214455Srpaulo * between incoming and outgoing packets, on a socket intended to 331214455Srpaulo * supply pppd with outgoing packets so it can do dial-on-demand and 332214455Srpaulo * hangup-on-lack-of-demand; incoming packets are filtered out so they 333214455Srpaulo * don't cause pppd to hold the connection up (you don't want random 334214455Srpaulo * input packets such as port scans, packets from old lost connections, 335214455Srpaulo * etc. to force the connection to stay up). 336214455Srpaulo * 337214455Srpaulo * The first byte of the PPP header (0xff03) is modified to accomodate 338214455Srpaulo * the direction - 0x00 = IN, 0x01 = OUT. 339214455Srpaulo */ 340214455Srpaulo#define LINKTYPE_PPP_PPPD 166 341214455Srpaulo 342214455Srpaulo/* 343214455Srpaulo * Juniper-private data link type, as per request from 344214455Srpaulo * Hannes Gredler <hannes@juniper.net>. The DLT_s are used 345214455Srpaulo * for passing on chassis-internal metainformation such as 346214455Srpaulo * QOS profiles, cookies, etc.. 347214455Srpaulo */ 348214455Srpaulo#define LINKTYPE_JUNIPER_PPPOE 167 349214455Srpaulo#define LINKTYPE_JUNIPER_PPPOE_ATM 168 350214455Srpaulo 351214455Srpaulo#define LINKTYPE_GPRS_LLC 169 /* GPRS LLC */ 352214455Srpaulo#define LINKTYPE_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */ 353214455Srpaulo#define LINKTYPE_GPF_F 171 /* GPF-T (ITU-T G.7041/Y.1303) */ 354214455Srpaulo 355214455Srpaulo/* 356214455Srpaulo * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line 357214455Srpaulo * monitoring equipment. 358214455Srpaulo */ 359214455Srpaulo#define LINKTYPE_GCOM_T1E1 172 360214455Srpaulo#define LINKTYPE_GCOM_SERIAL 173 361214455Srpaulo 362214455Srpaulo/* 363214455Srpaulo * Juniper-private data link type, as per request from 364214455Srpaulo * Hannes Gredler <hannes@juniper.net>. The DLT_ is used 365214455Srpaulo * for internal communication to Physical Interface Cards (PIC) 366214455Srpaulo */ 367214455Srpaulo#define LINKTYPE_JUNIPER_PIC_PEER 174 368214455Srpaulo 369214455Srpaulo/* 370214455Srpaulo * Link types requested by Gregor Maier <gregor@endace.com> of Endace 371214455Srpaulo * Measurement Systems. They add an ERF header (see 372214455Srpaulo * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of 373214455Srpaulo * the link-layer header. 374214455Srpaulo */ 375214455Srpaulo#define LINKTYPE_ERF_ETH 175 /* Ethernet */ 376214455Srpaulo#define LINKTYPE_ERF_POS 176 /* Packet-over-SONET */ 377214455Srpaulo 378214455Srpaulo/* 379214455Srpaulo * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD 380214455Srpaulo * for vISDN (http://www.orlandi.com/visdn/). Its link-layer header 381214455Srpaulo * includes additional information before the LAPD header, so it's 382214455Srpaulo * not necessarily a generic LAPD header. 383214455Srpaulo */ 384214455Srpaulo#define LINKTYPE_LINUX_LAPD 177 385214455Srpaulo 386214455Srpaulo/* 387214455Srpaulo * Juniper-private data link type, as per request from 388214455Srpaulo * Hannes Gredler <hannes@juniper.net>. 389214455Srpaulo * The Link Types are used for prepending meta-information 390214455Srpaulo * like interface index, interface name 391214455Srpaulo * before standard Ethernet, PPP, Frelay & C-HDLC Frames 392214455Srpaulo */ 393214455Srpaulo#define LINKTYPE_JUNIPER_ETHER 178 394214455Srpaulo#define LINKTYPE_JUNIPER_PPP 179 395214455Srpaulo#define LINKTYPE_JUNIPER_FRELAY 180 396214455Srpaulo#define LINKTYPE_JUNIPER_CHDLC 181 397214455Srpaulo 398214455Srpaulo/* 399214455Srpaulo * Multi Link Frame Relay (FRF.16) 400214455Srpaulo */ 401214455Srpaulo#define LINKTYPE_MFR 182 402214455Srpaulo 403214455Srpaulo/* 404214455Srpaulo * Juniper-private data link type, as per request from 405214455Srpaulo * Hannes Gredler <hannes@juniper.net>. 406214455Srpaulo * The DLT_ is used for internal communication with a 407214455Srpaulo * voice Adapter Card (PIC) 408214455Srpaulo */ 409214455Srpaulo#define LINKTYPE_JUNIPER_VP 183 410214455Srpaulo 411214455Srpaulo/* 412214455Srpaulo * Arinc 429 frames. 413214455Srpaulo * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 414214455Srpaulo * Every frame contains a 32bit A429 label. 415214455Srpaulo * More documentation on Arinc 429 can be found at 416214455Srpaulo * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf 417214455Srpaulo */ 418214455Srpaulo#define LINKTYPE_A429 184 419214455Srpaulo 420214455Srpaulo/* 421214455Srpaulo * Arinc 653 Interpartition Communication messages. 422214455Srpaulo * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 423214455Srpaulo * Please refer to the A653-1 standard for more information. 424214455Srpaulo */ 425214455Srpaulo#define LINKTYPE_A653_ICM 185 426214455Srpaulo 427214455Srpaulo/* 428214455Srpaulo * USB packets, beginning with a USB setup header; requested by 429214455Srpaulo * Paolo Abeni <paolo.abeni@email.it>. 430214455Srpaulo */ 431214455Srpaulo#define LINKTYPE_USB 186 432214455Srpaulo 433214455Srpaulo/* 434214455Srpaulo * Bluetooth HCI UART transport layer (part H:4); requested by 435214455Srpaulo * Paolo Abeni. 436214455Srpaulo */ 437214455Srpaulo#define LINKTYPE_BLUETOOTH_HCI_H4 187 438214455Srpaulo 439214455Srpaulo/* 440214455Srpaulo * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz 441214455Srpaulo * <cruz_petagay@bah.com>. 442214455Srpaulo */ 443214455Srpaulo#define LINKTYPE_IEEE802_16_MAC_CPS 188 444214455Srpaulo 445214455Srpaulo/* 446214455Srpaulo * USB packets, beginning with a Linux USB header; requested by 447214455Srpaulo * Paolo Abeni <paolo.abeni@email.it>. 448214455Srpaulo */ 449214455Srpaulo#define LINKTYPE_USB_LINUX 189 450214455Srpaulo 451214455Srpaulo/* 452214455Srpaulo * Controller Area Network (CAN) v. 2.0B packets. 453214455Srpaulo * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 454214455Srpaulo * Used to dump CAN packets coming from a CAN Vector board. 455214455Srpaulo * More documentation on the CAN v2.0B frames can be found at 456214455Srpaulo * http://www.can-cia.org/downloads/?269 457214455Srpaulo */ 458214455Srpaulo#define LINKTYPE_CAN20B 190 459214455Srpaulo 460214455Srpaulo/* 461214455Srpaulo * IEEE 802.15.4, with address fields padded, as is done by Linux 462214455Srpaulo * drivers; requested by Juergen Schimmer. 463214455Srpaulo */ 464214455Srpaulo#define LINKTYPE_IEEE802_15_4_LINUX 191 465214455Srpaulo 466214455Srpaulo/* 467214455Srpaulo * Per Packet Information encapsulated packets. 468214455Srpaulo * LINKTYPE_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. 469214455Srpaulo */ 470214455Srpaulo#define LINKTYPE_PPI 192 471214455Srpaulo 472214455Srpaulo/* 473214455Srpaulo * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header; 474214455Srpaulo * requested by Charles Clancy. 475214455Srpaulo */ 476214455Srpaulo#define LINKTYPE_IEEE802_16_MAC_CPS_RADIO 193 477214455Srpaulo 478214455Srpaulo/* 479214455Srpaulo * Juniper-private data link type, as per request from 480214455Srpaulo * Hannes Gredler <hannes@juniper.net>. 481214455Srpaulo * The DLT_ is used for internal communication with a 482214455Srpaulo * integrated service module (ISM). 483214455Srpaulo */ 484214455Srpaulo#define LINKTYPE_JUNIPER_ISM 194 485214455Srpaulo 486214455Srpaulo/* 487214455Srpaulo * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 488214455Srpaulo * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>. 489214455Srpaulo */ 490214455Srpaulo#define LINKTYPE_IEEE802_15_4 195 491214455Srpaulo 492214455Srpaulo/* 493214455Srpaulo * Various link-layer types, with a pseudo-header, for SITA 494214455Srpaulo * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com). 495214455Srpaulo */ 496214455Srpaulo#define LINKTYPE_SITA 196 497214455Srpaulo 498214455Srpaulo/* 499214455Srpaulo * Various link-layer types, with a pseudo-header, for Endace DAG cards; 500214455Srpaulo * encapsulates Endace ERF records. Requested by Stephen Donnelly 501214455Srpaulo * <stephen@endace.com>. 502214455Srpaulo */ 503214455Srpaulo#define LINKTYPE_ERF 197 504214455Srpaulo 505214455Srpaulo/* 506214455Srpaulo * Special header prepended to Ethernet packets when capturing from a 507214455Srpaulo * u10 Networks board. Requested by Phil Mulholland 508214455Srpaulo * <phil@u10networks.com>. 509214455Srpaulo */ 510214455Srpaulo#define LINKTYPE_RAIF1 198 511214455Srpaulo 512214455Srpaulo/* 513214455Srpaulo * IPMB packet for IPMI, beginning with the I2C slave address, followed 514214455Srpaulo * by the netFn and LUN, etc.. Requested by Chanthy Toeung 515214455Srpaulo * <chanthy.toeung@ca.kontron.com>. 516214455Srpaulo */ 517214455Srpaulo#define LINKTYPE_IPMB 199 518214455Srpaulo 519214455Srpaulo/* 520214455Srpaulo * Juniper-private data link type, as per request from 521214455Srpaulo * Hannes Gredler <hannes@juniper.net>. 522214455Srpaulo * The DLT_ is used for capturing data on a secure tunnel interface. 523214455Srpaulo */ 524214455Srpaulo#define LINKTYPE_JUNIPER_ST 200 525214455Srpaulo 526214455Srpaulo/* 527214455Srpaulo * Bluetooth HCI UART transport layer (part H:4), with pseudo-header 528214455Srpaulo * that includes direction information; requested by Paolo Abeni. 529214455Srpaulo */ 530214455Srpaulo#define LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR 201 531214455Srpaulo 532214455Srpaulo/* 533214455Srpaulo * AX.25 packet with a 1-byte KISS header; see 534214455Srpaulo * 535214455Srpaulo * http://www.ax25.net/kiss.htm 536214455Srpaulo * 537214455Srpaulo * as per Richard Stearn <richard@rns-stearn.demon.co.uk>. 538214455Srpaulo */ 539214455Srpaulo#define LINKTYPE_AX25_KISS 202 540214455Srpaulo 541214455Srpaulo/* 542214455Srpaulo * LAPD packets from an ISDN channel, starting with the address field, 543214455Srpaulo * with no pseudo-header. 544214455Srpaulo * Requested by Varuna De Silva <varunax@gmail.com>. 545214455Srpaulo */ 546214455Srpaulo#define LINKTYPE_LAPD 203 547214455Srpaulo 548214455Srpaulo/* 549214455Srpaulo * Variants of various link-layer headers, with a one-byte direction 550214455Srpaulo * pseudo-header prepended - zero means "received by this host", 551214455Srpaulo * non-zero (any non-zero value) means "sent by this host" - as per 552214455Srpaulo * Will Barker <w.barker@zen.co.uk>. 553214455Srpaulo */ 554214455Srpaulo#define LINKTYPE_PPP_WITH_DIR 204 /* PPP */ 555214455Srpaulo#define LINKTYPE_C_HDLC_WITH_DIR 205 /* Cisco HDLC */ 556214455Srpaulo#define LINKTYPE_FRELAY_WITH_DIR 206 /* Frame Relay */ 557214455Srpaulo#define LINKTYPE_LAPB_WITH_DIR 207 /* LAPB */ 558214455Srpaulo 559214455Srpaulo/* 560214455Srpaulo * 208 is reserved for an as-yet-unspecified proprietary link-layer 561214455Srpaulo * type, as requested by Will Barker. 562214455Srpaulo */ 563214455Srpaulo 564214455Srpaulo/* 565214455Srpaulo * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman 566214455Srpaulo * <avn@pigeonpoint.com>. 567214455Srpaulo */ 568235426Sdelphij#define LINKTYPE_IPMB_LINUX 209 569214455Srpaulo 570214455Srpaulo/* 571214455Srpaulo * FlexRay automotive bus - http://www.flexray.com/ - as requested 572214455Srpaulo * by Hannes Kaelber <hannes.kaelber@x2e.de>. 573214455Srpaulo */ 574235426Sdelphij#define LINKTYPE_FLEXRAY 210 575214455Srpaulo 576214455Srpaulo/* 577214455Srpaulo * Media Oriented Systems Transport (MOST) bus for multimedia 578214455Srpaulo * transport - http://www.mostcooperation.com/ - as requested 579214455Srpaulo * by Hannes Kaelber <hannes.kaelber@x2e.de>. 580214455Srpaulo */ 581235426Sdelphij#define LINKTYPE_MOST 211 582214455Srpaulo 583214455Srpaulo/* 584214455Srpaulo * Local Interconnect Network (LIN) bus for vehicle networks - 585214455Srpaulo * http://www.lin-subbus.org/ - as requested by Hannes Kaelber 586214455Srpaulo * <hannes.kaelber@x2e.de>. 587214455Srpaulo */ 588235426Sdelphij#define LINKTYPE_LIN 212 589214455Srpaulo 590214455Srpaulo/* 591214455Srpaulo * X2E-private data link type used for serial line capture, 592214455Srpaulo * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>. 593214455Srpaulo */ 594235426Sdelphij#define LINKTYPE_X2E_SERIAL 213 595214455Srpaulo 596214455Srpaulo/* 597214455Srpaulo * X2E-private data link type used for the Xoraya data logger 598214455Srpaulo * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>. 599214455Srpaulo */ 600235426Sdelphij#define LINKTYPE_X2E_XORAYA 214 601214455Srpaulo 602214455Srpaulo/* 603214455Srpaulo * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 604214455Srpaulo * nothing), but with the PHY-level data for non-ASK PHYs (4 octets 605214455Srpaulo * of 0 as preamble, one octet of SFD, one octet of frame length+ 606214455Srpaulo * reserved bit, and then the MAC-layer data, starting with the 607214455Srpaulo * frame control field). 608214455Srpaulo * 609214455Srpaulo * Requested by Max Filippov <jcmvbkbc@gmail.com>. 610214455Srpaulo */ 611214455Srpaulo#define LINKTYPE_IEEE802_15_4_NONASK_PHY 215 612214455Srpaulo 613214455Srpaulo/* 614214455Srpaulo * David Gibson <david@gibson.dropbear.id.au> requested this for 615214455Srpaulo * captures from the Linux kernel /dev/input/eventN devices. This 616214455Srpaulo * is used to communicate keystrokes and mouse movements from the 617214455Srpaulo * Linux kernel to display systems, such as Xorg. 618214455Srpaulo */ 619235426Sdelphij#define LINKTYPE_LINUX_EVDEV 216 620214455Srpaulo 621214455Srpaulo/* 622214455Srpaulo * GSM Um and Abis interfaces, preceded by a "gsmtap" header. 623214455Srpaulo * 624214455Srpaulo * Requested by Harald Welte <laforge@gnumonks.org>. 625214455Srpaulo */ 626235426Sdelphij#define LINKTYPE_GSMTAP_UM 217 627235426Sdelphij#define LINKTYPE_GSMTAP_ABIS 218 628214455Srpaulo 629214455Srpaulo/* 630214455Srpaulo * MPLS, with an MPLS label as the link-layer header. 631214455Srpaulo * Requested by Michele Marchetto <michele@openbsd.org> on behalf 632214455Srpaulo * of OpenBSD. 633214455Srpaulo */ 634235426Sdelphij#define LINKTYPE_MPLS 219 635214455Srpaulo 636214455Srpaulo/* 637214455Srpaulo * USB packets, beginning with a Linux USB header, with the USB header 638214455Srpaulo * padded to 64 bytes; required for memory-mapped access. 639214455Srpaulo */ 640214455Srpaulo#define LINKTYPE_USB_LINUX_MMAPPED 220 641214455Srpaulo 642214455Srpaulo/* 643214455Srpaulo * DECT packets, with a pseudo-header; requested by 644214455Srpaulo * Matthias Wenzel <tcpdump@mazzoo.de>. 645214455Srpaulo */ 646235426Sdelphij#define LINKTYPE_DECT 221 647214455Srpaulo 648214455Srpaulo/* 649214455Srpaulo * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov> 650214455Srpaulo * Date: Mon, 11 May 2009 11:18:30 -0500 651214455Srpaulo * 652214455Srpaulo * DLT_AOS. We need it for AOS Space Data Link Protocol. 653214455Srpaulo * I have already written dissectors for but need an OK from 654214455Srpaulo * legal before I can submit a patch. 655214455Srpaulo * 656214455Srpaulo */ 657235426Sdelphij#define LINKTYPE_AOS 222 658214455Srpaulo 659214455Srpaulo/* 660214455Srpaulo * Wireless HART (Highway Addressable Remote Transducer) 661214455Srpaulo * From the HART Communication Foundation 662214455Srpaulo * IES/PAS 62591 663214455Srpaulo * 664214455Srpaulo * Requested by Sam Roberts <vieuxtech@gmail.com>. 665214455Srpaulo */ 666235426Sdelphij#define LINKTYPE_WIHART 223 667214455Srpaulo 668214455Srpaulo/* 669214455Srpaulo * Fibre Channel FC-2 frames, beginning with a Frame_Header. 670214455Srpaulo * Requested by Kahou Lei <kahou82@gmail.com>. 671214455Srpaulo */ 672235426Sdelphij#define LINKTYPE_FC_2 224 673214455Srpaulo 674214455Srpaulo/* 675214455Srpaulo * Fibre Channel FC-2 frames, beginning with an encoding of the 676214455Srpaulo * SOF, and ending with an encoding of the EOF. 677214455Srpaulo * 678214455Srpaulo * The encodings represent the frame delimiters as 4-byte sequences 679214455Srpaulo * representing the corresponding ordered sets, with K28.5 680214455Srpaulo * represented as 0xBC, and the D symbols as the corresponding 681214455Srpaulo * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2, 682214455Srpaulo * is represented as 0xBC 0xB5 0x55 0x55. 683214455Srpaulo * 684214455Srpaulo * Requested by Kahou Lei <kahou82@gmail.com>. 685214455Srpaulo */ 686214455Srpaulo#define LINKTYPE_FC_2_WITH_FRAME_DELIMS 225 687214455Srpaulo 688214455Srpaulo/* 689214455Srpaulo * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>. 690214455Srpaulo * 691214455Srpaulo * The pseudo-header starts with a one-byte version number; for version 2, 692214455Srpaulo * the pseudo-header is: 693214455Srpaulo * 694214455Srpaulo * struct dl_ipnetinfo { 695214455Srpaulo * u_int8_t dli_version; 696214455Srpaulo * u_int8_t dli_family; 697214455Srpaulo * u_int16_t dli_htype; 698214455Srpaulo * u_int32_t dli_pktlen; 699214455Srpaulo * u_int32_t dli_ifindex; 700214455Srpaulo * u_int32_t dli_grifindex; 701214455Srpaulo * u_int32_t dli_zsrc; 702214455Srpaulo * u_int32_t dli_zdst; 703214455Srpaulo * }; 704214455Srpaulo * 705214455Srpaulo * dli_version is 2 for the current version of the pseudo-header. 706214455Srpaulo * 707214455Srpaulo * dli_family is a Solaris address family value, so it's 2 for IPv4 708214455Srpaulo * and 26 for IPv6. 709214455Srpaulo * 710214455Srpaulo * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing 711214455Srpaulo * packets, and 2 for packets arriving from another zone on the same 712214455Srpaulo * machine. 713214455Srpaulo * 714214455Srpaulo * dli_pktlen is the length of the packet data following the pseudo-header 715214455Srpaulo * (so the captured length minus dli_pktlen is the length of the 716214455Srpaulo * pseudo-header, assuming the entire pseudo-header was captured). 717214455Srpaulo * 718214455Srpaulo * dli_ifindex is the interface index of the interface on which the 719214455Srpaulo * packet arrived. 720214455Srpaulo * 721214455Srpaulo * dli_grifindex is the group interface index number (for IPMP interfaces). 722214455Srpaulo * 723214455Srpaulo * dli_zsrc is the zone identifier for the source of the packet. 724214455Srpaulo * 725214455Srpaulo * dli_zdst is the zone identifier for the destination of the packet. 726214455Srpaulo * 727214455Srpaulo * A zone number of 0 is the global zone; a zone number of 0xffffffff 728214455Srpaulo * means that the packet arrived from another host on the network, not 729214455Srpaulo * from another zone on the same machine. 730214455Srpaulo * 731214455Srpaulo * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates 732214455Srpaulo * which of those it is. 733214455Srpaulo */ 734235426Sdelphij#define LINKTYPE_IPNET 226 735214455Srpaulo 736214455Srpaulo/* 737214455Srpaulo * CAN (Controller Area Network) frames, with a pseudo-header as supplied 738214455Srpaulo * by Linux SocketCAN. See Documentation/networking/can.txt in the Linux 739214455Srpaulo * source. 740214455Srpaulo * 741214455Srpaulo * Requested by Felix Obenhuber <felix@obenhuber.de>. 742214455Srpaulo */ 743235426Sdelphij#define LINKTYPE_CAN_SOCKETCAN 227 744214455Srpaulo 745214455Srpaulo/* 746214455Srpaulo * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies 747214455Srpaulo * whether it's v4 or v6. Requested by Darren Reed <Darren.Reed@Sun.COM>. 748214455Srpaulo */ 749235426Sdelphij#define LINKTYPE_IPV4 228 750235426Sdelphij#define LINKTYPE_IPV6 229 751214455Srpaulo 752235426Sdelphij/* 753235426Sdelphij * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 754235426Sdelphij * nothing), and with no FCS at the end of the frame; requested by 755235426Sdelphij * Jon Smirl <jonsmirl@gmail.com>. 756235426Sdelphij */ 757235426Sdelphij#define LINKTYPE_IEEE802_15_4_NOFCS 230 758214455Srpaulo 759235426Sdelphij/* 760235426Sdelphij * Raw D-Bus: 761235426Sdelphij * 762235426Sdelphij * http://www.freedesktop.org/wiki/Software/dbus 763235426Sdelphij * 764235426Sdelphij * messages: 765235426Sdelphij * 766235426Sdelphij * http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages 767235426Sdelphij * 768235426Sdelphij * starting with the endianness flag, followed by the message type, etc., 769235426Sdelphij * but without the authentication handshake before the message sequence: 770235426Sdelphij * 771235426Sdelphij * http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol 772235426Sdelphij * 773235426Sdelphij * Requested by Martin Vidner <martin@vidner.net>. 774235426Sdelphij */ 775235426Sdelphij#define LINKTYPE_DBUS 231 776235426Sdelphij 777235426Sdelphij/* 778235426Sdelphij * Juniper-private data link type, as per request from 779235426Sdelphij * Hannes Gredler <hannes@juniper.net>. 780235426Sdelphij */ 781235426Sdelphij#define LINKTYPE_JUNIPER_VS 232 782235426Sdelphij#define LINKTYPE_JUNIPER_SRX_E2E 233 783235426Sdelphij#define LINKTYPE_JUNIPER_FIBRECHANNEL 234 784235426Sdelphij 785235426Sdelphij/* 786235426Sdelphij * DVB-CI (DVB Common Interface for communication between a PC Card 787235426Sdelphij * module and a DVB receiver). See 788235426Sdelphij * 789235426Sdelphij * http://www.kaiser.cx/pcap-dvbci.html 790235426Sdelphij * 791235426Sdelphij * for the specification. 792235426Sdelphij * 793235426Sdelphij * Requested by Martin Kaiser <martin@kaiser.cx>. 794235426Sdelphij */ 795235426Sdelphij#define LINKTYPE_DVB_CI 235 796235426Sdelphij 797235426Sdelphij/* 798235426Sdelphij * Variant of 3GPP TS 27.010 multiplexing protocol. Requested 799235426Sdelphij * by Hans-Christoph Schemmel <hans-christoph.schemmel@cinterion.com>. 800235426Sdelphij */ 801235426Sdelphij#define LINKTYPE_MUX27010 236 802235426Sdelphij 803235426Sdelphij/* 804235426Sdelphij * STANAG 5066 D_PDUs. Requested by M. Baris Demiray 805235426Sdelphij * <barisdemiray@gmail.com>. 806235426Sdelphij */ 807235426Sdelphij#define LINKTYPE_STANAG_5066_D_PDU 237 808235426Sdelphij 809235426Sdelphij/* 810235426Sdelphij * Juniper-private data link type, as per request from 811235426Sdelphij * Hannes Gredler <hannes@juniper.net>. 812235426Sdelphij */ 813235426Sdelphij#define LINKTYPE_JUNIPER_ATM_CEMIC 238 814235426Sdelphij 815235426Sdelphij/* 816235426Sdelphij * NetFilter LOG messages 817235426Sdelphij * (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets) 818235426Sdelphij * 819235426Sdelphij * Requested by Jakub Zawadzki <darkjames-ws@darkjames.pl> 820235426Sdelphij */ 821235426Sdelphij#define LINKTYPE_NFLOG 239 822235426Sdelphij 823235426Sdelphij/* 824235426Sdelphij * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type 825235426Sdelphij * for Ethernet packets with a 4-byte pseudo-header and always 826235426Sdelphij * with the payload including the FCS, as supplied by their 827235426Sdelphij * netANALYZER hardware and software. 828235426Sdelphij * 829235426Sdelphij * Requested by Holger P. Frommer <HPfrommer@hilscher.com> 830235426Sdelphij */ 831235426Sdelphij#define LINKTYPE_NETANALYZER 240 832235426Sdelphij 833235426Sdelphij/* 834235426Sdelphij * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type 835235426Sdelphij * for Ethernet packets with a 4-byte pseudo-header and FCS and 836235426Sdelphij * 1 byte of SFD, as supplied by their netANALYZER hardware and 837235426Sdelphij * software. 838235426Sdelphij * 839235426Sdelphij * Requested by Holger P. Frommer <HPfrommer@hilscher.com> 840235426Sdelphij */ 841235426Sdelphij#define LINKTYPE_NETANALYZER_TRANSPARENT 241 842235426Sdelphij 843235426Sdelphij/* 844251129Sdelphij * IP-over-InfiniBand, as specified by RFC 4391. 845235426Sdelphij * 846235426Sdelphij * Requested by Petr Sumbera <petr.sumbera@oracle.com>. 847235426Sdelphij */ 848235426Sdelphij#define LINKTYPE_IPOIB 242 849235426Sdelphij 850241231Sdelphij/* 851241231Sdelphij * MPEG-2 transport stream (ISO 13818-1/ITU-T H.222.0). 852241231Sdelphij * 853241231Sdelphij * Requested by Guy Martin <gmsoft@tuxicoman.be>. 854241231Sdelphij */ 855241231Sdelphij#define LINKTYPE_MPEG_2_TS 243 856235426Sdelphij 857241231Sdelphij/* 858241231Sdelphij * ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as 859241231Sdelphij * used by their ng40 protocol tester. 860241231Sdelphij * 861241231Sdelphij * Requested by Jens Grimmer <jens.grimmer@ng4t.com>. 862241231Sdelphij */ 863241231Sdelphij#define LINKTYPE_NG40 244 864241231Sdelphij 865241231Sdelphij/* 866241231Sdelphij * Pseudo-header giving adapter number and flags, followed by an NFC 867241231Sdelphij * (Near-Field Communications) Logical Link Control Protocol (LLCP) PDU, 868241231Sdelphij * as specified by NFC Forum Logical Link Control Protocol Technical 869241231Sdelphij * Specification LLCP 1.1. 870241231Sdelphij * 871241231Sdelphij * Requested by Mike Wakerly <mikey@google.com>. 872241231Sdelphij */ 873241231Sdelphij#define LINKTYPE_NFC_LLCP 245 874241231Sdelphij 875241231Sdelphij/* 876241231Sdelphij * pfsync output; DLT_PFSYNC is 18, which collides with DLT_CIP in 877241231Sdelphij * SuSE 6.3, on OpenBSD, NetBSD, DragonFly BSD, and Mac OS X, and 878241231Sdelphij * is 121, which collides with DLT_HHDLC, in FreeBSD. We pick a 879241231Sdelphij * shiny new link-layer header type value that doesn't collide with 880241231Sdelphij * anything, in the hopes that future pfsync savefiles, if any, 881241231Sdelphij * won't require special hacks to distinguish from other savefiles. 882241231Sdelphij * 883241231Sdelphij */ 884241231Sdelphij#define LINKTYPE_PFSYNC 246 885241231Sdelphij 886251129Sdelphij/* 887251129Sdelphij * Raw InfiniBand packets, starting with the Local Routing Header. 888251129Sdelphij * 889251129Sdelphij * Requested by Oren Kladnitsky <orenk@mellanox.com>. 890251129Sdelphij */ 891251129Sdelphij#define LINKTYPE_INFINIBAND 247 892241231Sdelphij 893251129Sdelphij/* 894251129Sdelphij * SCTP, with no lower-level protocols (i.e., no IPv4 or IPv6). 895251129Sdelphij * 896251129Sdelphij * Requested by Michael Tuexen <Michael.Tuexen@lurchi.franken.de>. 897251129Sdelphij */ 898251129Sdelphij#define LINKTYPE_SCTP 248 899251129Sdelphij 900251129Sdelphij#define LINKTYPE_MATCHING_MAX 248 /* highest value in the "matching" range */ 901251129Sdelphij 902214455Srpaulostatic struct linktype_map { 903214455Srpaulo int dlt; 904214455Srpaulo int linktype; 905214455Srpaulo} map[] = { 906214455Srpaulo /* 907214455Srpaulo * These DLT_* codes have LINKTYPE_* codes with values identical 908214455Srpaulo * to the values of the corresponding DLT_* code. 909214455Srpaulo */ 910214455Srpaulo { DLT_NULL, LINKTYPE_NULL }, 911214455Srpaulo { DLT_EN10MB, LINKTYPE_ETHERNET }, 912214455Srpaulo { DLT_EN3MB, LINKTYPE_EXP_ETHERNET }, 913214455Srpaulo { DLT_AX25, LINKTYPE_AX25 }, 914214455Srpaulo { DLT_PRONET, LINKTYPE_PRONET }, 915214455Srpaulo { DLT_CHAOS, LINKTYPE_CHAOS }, 916241231Sdelphij { DLT_IEEE802, LINKTYPE_IEEE802_5 }, 917235426Sdelphij { DLT_ARCNET, LINKTYPE_ARCNET_BSD }, 918214455Srpaulo { DLT_SLIP, LINKTYPE_SLIP }, 919214455Srpaulo { DLT_PPP, LINKTYPE_PPP }, 920214455Srpaulo { DLT_FDDI, LINKTYPE_FDDI }, 921241231Sdelphij { DLT_SYMANTEC_FIREWALL, LINKTYPE_SYMANTEC_FIREWALL }, 922214455Srpaulo 923214455Srpaulo /* 924214455Srpaulo * These DLT_* codes have different values on different 925214455Srpaulo * platforms; we map them to LINKTYPE_* codes that 926214455Srpaulo * have values that should never be equal to any DLT_* 927214455Srpaulo * code. 928214455Srpaulo */ 929214455Srpaulo#ifdef DLT_FR 930214455Srpaulo /* BSD/OS Frame Relay */ 931214455Srpaulo { DLT_FR, LINKTYPE_FRELAY }, 932214455Srpaulo#endif 933214455Srpaulo 934214455Srpaulo { DLT_ATM_RFC1483, LINKTYPE_ATM_RFC1483 }, 935214455Srpaulo { DLT_RAW, LINKTYPE_RAW }, 936214455Srpaulo { DLT_SLIP_BSDOS, LINKTYPE_SLIP_BSDOS }, 937214455Srpaulo { DLT_PPP_BSDOS, LINKTYPE_PPP_BSDOS }, 938214455Srpaulo 939214455Srpaulo /* BSD/OS Cisco HDLC */ 940214455Srpaulo { DLT_C_HDLC, LINKTYPE_C_HDLC }, 941214455Srpaulo 942214455Srpaulo /* 943214455Srpaulo * These DLT_* codes are not on all platforms, but, so far, 944214455Srpaulo * there don't appear to be any platforms that define 945214455Srpaulo * other codes with those values; we map them to 946214455Srpaulo * different LINKTYPE_* values anyway, just in case. 947214455Srpaulo */ 948214455Srpaulo 949214455Srpaulo /* Linux ATM Classical IP */ 950214455Srpaulo { DLT_ATM_CLIP, LINKTYPE_ATM_CLIP }, 951214455Srpaulo 952214455Srpaulo /* NetBSD sync/async serial PPP (or Cisco HDLC) */ 953214455Srpaulo { DLT_PPP_SERIAL, LINKTYPE_PPP_HDLC }, 954214455Srpaulo 955214455Srpaulo /* NetBSD PPP over Ethernet */ 956214455Srpaulo { DLT_PPP_ETHER, LINKTYPE_PPP_ETHER }, 957214455Srpaulo 958214455Srpaulo /* 959235426Sdelphij * All LINKTYPE_ values between LINKTYPE_MATCHING_MIN 960235426Sdelphij * and LINKTYPE_MATCHING_MAX are mapped to identical 961235426Sdelphij * DLT_ values. 962214455Srpaulo */ 963214455Srpaulo 964214455Srpaulo { -1, -1 } 965214455Srpaulo}; 966214455Srpaulo 967214455Srpauloint 968214455Srpaulodlt_to_linktype(int dlt) 969214455Srpaulo{ 970214455Srpaulo int i; 971214455Srpaulo 972235426Sdelphij /* 973241231Sdelphij * Map DLT_PFSYNC, whatever it might be, to LINKTYPE_PFSYNC. 974241231Sdelphij */ 975241231Sdelphij if (dlt == DLT_PFSYNC) 976241231Sdelphij return (LINKTYPE_PFSYNC); 977241231Sdelphij 978241231Sdelphij /* 979235426Sdelphij * Map the values in the matching range. 980235426Sdelphij */ 981235426Sdelphij if (dlt >= DLT_MATCHING_MIN && dlt <= DLT_MATCHING_MAX) 982235426Sdelphij return (dlt); 983235426Sdelphij 984235426Sdelphij /* 985235426Sdelphij * Map the values outside that range. 986235426Sdelphij */ 987214455Srpaulo for (i = 0; map[i].dlt != -1; i++) { 988214455Srpaulo if (map[i].dlt == dlt) 989214455Srpaulo return (map[i].linktype); 990214455Srpaulo } 991214455Srpaulo 992214455Srpaulo /* 993214455Srpaulo * If we don't have a mapping for this DLT_ code, return an 994235426Sdelphij * error; that means that this is a value with no corresponding 995235426Sdelphij * LINKTYPE_ code, and we need to assign one. 996214455Srpaulo */ 997214455Srpaulo return (-1); 998214455Srpaulo} 999214455Srpaulo 1000214455Srpauloint 1001214455Srpaulolinktype_to_dlt(int linktype) 1002214455Srpaulo{ 1003214455Srpaulo int i; 1004214455Srpaulo 1005235426Sdelphij /* 1006241231Sdelphij * Map LINKTYPE_PFSYNC to DLT_PFSYNC, whatever it might be. 1007241231Sdelphij * LINKTYPE_PFSYNC is in the matching range, to make sure 1008241231Sdelphij * it's as safe from reuse as we can arrange, so we do 1009241231Sdelphij * this test first. 1010241231Sdelphij */ 1011241231Sdelphij if (linktype == LINKTYPE_PFSYNC) 1012241231Sdelphij return (DLT_PFSYNC); 1013241231Sdelphij 1014241231Sdelphij /* 1015235426Sdelphij * Map the values in the matching range. 1016235426Sdelphij */ 1017235426Sdelphij if (linktype >= LINKTYPE_MATCHING_MIN && 1018235426Sdelphij linktype <= LINKTYPE_MATCHING_MAX) 1019235426Sdelphij return (linktype); 1020235426Sdelphij 1021235426Sdelphij /* 1022235426Sdelphij * Map the values outside that range. 1023235426Sdelphij */ 1024214455Srpaulo for (i = 0; map[i].linktype != -1; i++) { 1025214455Srpaulo if (map[i].linktype == linktype) 1026214455Srpaulo return (map[i].dlt); 1027214455Srpaulo } 1028214455Srpaulo 1029214455Srpaulo /* 1030214455Srpaulo * If we don't have an entry for this link type, return 1031214455Srpaulo * the link type value; it may be a DLT_ value from an 1032214455Srpaulo * older version of libpcap. 1033214455Srpaulo */ 1034214455Srpaulo return linktype; 1035214455Srpaulo} 1036214455Srpaulo 1037214455Srpaulo/* 1038214455Srpaulo * The DLT_USB_LINUX and DLT_USB_LINUX_MMAPPED headers are in host 1039214455Srpaulo * byte order when capturing (it's supplied directly from a 1040214455Srpaulo * memory-mapped buffer shared by the kernel). 1041214455Srpaulo * 1042214455Srpaulo * When reading a DLT_USB_LINUX or DLT_USB_LINUX_MMAPPED capture file, 1043214455Srpaulo * we need to convert it from the capturing host's byte order to 1044214455Srpaulo * the reading host's byte order. 1045214455Srpaulo */ 1046214455Srpaulovoid 1047214455Srpauloswap_linux_usb_header(const struct pcap_pkthdr *hdr, u_char *buf, 1048214455Srpaulo int header_len_64_bytes) 1049214455Srpaulo{ 1050214455Srpaulo pcap_usb_header_mmapped *uhdr = (pcap_usb_header_mmapped *)buf; 1051235426Sdelphij bpf_u_int32 offset = 0; 1052235426Sdelphij usb_isodesc *pisodesc; 1053235426Sdelphij int32_t numdesc, i; 1054214455Srpaulo 1055214455Srpaulo /* 1056235426Sdelphij * "offset" is the offset *past* the field we're swapping; 1057235426Sdelphij * we skip the field *before* checking to make sure 1058235426Sdelphij * the captured data length includes the entire field. 1059235426Sdelphij */ 1060235426Sdelphij 1061235426Sdelphij /* 1062214455Srpaulo * The URB id is a totally opaque value; do we really need to 1063214455Srpaulo * convert it to the reading host's byte order??? 1064214455Srpaulo */ 1065235426Sdelphij offset += 8; /* skip past id */ 1066235426Sdelphij if (hdr->caplen < offset) 1067214455Srpaulo return; 1068214455Srpaulo uhdr->id = SWAPLL(uhdr->id); 1069235426Sdelphij 1070235426Sdelphij offset += 4; /* skip past various 1-byte fields */ 1071235426Sdelphij 1072235426Sdelphij offset += 2; /* skip past bus_id */ 1073235426Sdelphij if (hdr->caplen < offset) 1074214455Srpaulo return; 1075214455Srpaulo uhdr->bus_id = SWAPSHORT(uhdr->bus_id); 1076235426Sdelphij 1077235426Sdelphij offset += 2; /* skip past various 1-byte fields */ 1078235426Sdelphij 1079235426Sdelphij offset += 8; /* skip past ts_sec */ 1080235426Sdelphij if (hdr->caplen < offset) 1081214455Srpaulo return; 1082214455Srpaulo uhdr->ts_sec = SWAPLL(uhdr->ts_sec); 1083235426Sdelphij 1084235426Sdelphij offset += 4; /* skip past ts_usec */ 1085235426Sdelphij if (hdr->caplen < offset) 1086214455Srpaulo return; 1087214455Srpaulo uhdr->ts_usec = SWAPLONG(uhdr->ts_usec); 1088235426Sdelphij 1089235426Sdelphij offset += 4; /* skip past status */ 1090235426Sdelphij if (hdr->caplen < offset) 1091214455Srpaulo return; 1092214455Srpaulo uhdr->status = SWAPLONG(uhdr->status); 1093235426Sdelphij 1094235426Sdelphij offset += 4; /* skip past urb_len */ 1095235426Sdelphij if (hdr->caplen < offset) 1096214455Srpaulo return; 1097214455Srpaulo uhdr->urb_len = SWAPLONG(uhdr->urb_len); 1098235426Sdelphij 1099235426Sdelphij offset += 4; /* skip past data_len */ 1100235426Sdelphij if (hdr->caplen < offset) 1101214455Srpaulo return; 1102214455Srpaulo uhdr->data_len = SWAPLONG(uhdr->data_len); 1103214455Srpaulo 1104235426Sdelphij if (uhdr->transfer_type == URB_ISOCHRONOUS) { 1105235426Sdelphij offset += 4; /* skip past s.iso.error_count */ 1106235426Sdelphij if (hdr->caplen < offset) 1107235426Sdelphij return; 1108235426Sdelphij uhdr->s.iso.error_count = SWAPLONG(uhdr->s.iso.error_count); 1109235426Sdelphij 1110235426Sdelphij offset += 4; /* skip past s.iso.numdesc */ 1111235426Sdelphij if (hdr->caplen < offset) 1112235426Sdelphij return; 1113235426Sdelphij uhdr->s.iso.numdesc = SWAPLONG(uhdr->s.iso.numdesc); 1114235426Sdelphij } else 1115235426Sdelphij offset += 8; /* skip USB setup header */ 1116235426Sdelphij 1117214455Srpaulo if (header_len_64_bytes) { 1118214455Srpaulo /* 1119214455Srpaulo * This is either the "version 1" header, with 1120214455Srpaulo * 16 bytes of additional fields at the end, or 1121214455Srpaulo * a "version 0" header from a memory-mapped 1122214455Srpaulo * capture, with 16 bytes of zeroed-out padding 1123214455Srpaulo * at the end. Byte swap them as if this were 1124214455Srpaulo * a "version 1" header. 1125214455Srpaulo */ 1126235426Sdelphij offset += 4; /* skip past interval */ 1127235426Sdelphij if (hdr->caplen < offset) 1128214455Srpaulo return; 1129214455Srpaulo uhdr->interval = SWAPLONG(uhdr->interval); 1130235426Sdelphij 1131235426Sdelphij offset += 4; /* skip past start_frame */ 1132235426Sdelphij if (hdr->caplen < offset) 1133214455Srpaulo return; 1134214455Srpaulo uhdr->start_frame = SWAPLONG(uhdr->start_frame); 1135235426Sdelphij 1136235426Sdelphij offset += 4; /* skip past xfer_flags */ 1137235426Sdelphij if (hdr->caplen < offset) 1138214455Srpaulo return; 1139214455Srpaulo uhdr->xfer_flags = SWAPLONG(uhdr->xfer_flags); 1140235426Sdelphij 1141235426Sdelphij offset += 4; /* skip past ndesc */ 1142235426Sdelphij if (hdr->caplen < offset) 1143214455Srpaulo return; 1144214455Srpaulo uhdr->ndesc = SWAPLONG(uhdr->ndesc); 1145214455Srpaulo } 1146235426Sdelphij 1147235426Sdelphij if (uhdr->transfer_type == URB_ISOCHRONOUS) { 1148235426Sdelphij /* swap the values in struct linux_usb_isodesc */ 1149235426Sdelphij pisodesc = (usb_isodesc *)(void *)(buf+offset); 1150235426Sdelphij numdesc = uhdr->s.iso.numdesc; 1151235426Sdelphij for (i = 0; i < numdesc; i++) { 1152235426Sdelphij offset += 4; /* skip past status */ 1153235426Sdelphij if (hdr->caplen < offset) 1154235426Sdelphij return; 1155235426Sdelphij pisodesc->status = SWAPLONG(pisodesc->status); 1156235426Sdelphij 1157235426Sdelphij offset += 4; /* skip past offset */ 1158235426Sdelphij if (hdr->caplen < offset) 1159235426Sdelphij return; 1160235426Sdelphij pisodesc->offset = SWAPLONG(pisodesc->offset); 1161235426Sdelphij 1162235426Sdelphij offset += 4; /* skip past len */ 1163235426Sdelphij if (hdr->caplen < offset) 1164235426Sdelphij return; 1165235426Sdelphij pisodesc->len = SWAPLONG(pisodesc->len); 1166235426Sdelphij 1167235426Sdelphij offset += 4; /* skip past padding */ 1168235426Sdelphij 1169235426Sdelphij pisodesc++; 1170235426Sdelphij } 1171235426Sdelphij } 1172214455Srpaulo} 1173