On Thu, 2009-07-09 at 14:42 -0400, Sebastien Roy wrote: > FYI, I've added section 14 to the IP tunneling design document to > discuss changes needed in libpcap to support capture of the Clearview IP > Tunneling links. > > http://www.opensolaris.org/os/project/clearview/iptun/iptun-design.pdf
And the code changes in question are: http://cr.opensolaris.org/~seb/clearview-libpcap/ The idea is to translate DL_IPV4, DL_IPV6, and DL_6TO4 to DLT_RAW, which indicates that captured packets begin with an IP header. Wireshark can then decode them seamlessly without any modification to the application. Note that I'm including a DLT_RAW conversion for DL_IPNET as well, as we've had IP observability in ON for a long time now with no way to decode them using wireshark. This at least allows one to capture on "ipnet/<something>" or "lo0" and get back raw IP packets. Things will change with the BPF project, which will add an ipnet-specific DLT-type that will be used to decode the ipnet header. For now, I think these libpcap changes will be a fine bridge to this future work. -Seb
