On 05/10/2015 02:37 PM, Vadim Kochan wrote:
From: Vadim Kochan <[email protected]>Since Netlink messages are written in default pcap format there is no way to identify Netlink family by socket protocol number, so use pcap cooked header for Netlink messages as described here: http://www.tcpdump.org/linktypes/LINKTYPE_NETLINK.html Signed-off-by: Vadim Kochan <[email protected]>
Thanks for looking into this, Vadim! One preliminary question: you would only set that for netlink or also for other protocols? The basic issue is that normal pcap hdr in front of every captured packet looses this information for the dissector, but alternative formats such as kuznet/netsniff-ng format still have it preserved, but are not supported by tools like wireshark. Ok. Thinking out loud, what if we add another pcap type as an option to choose? -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
