On Wed, May 13, 2015 at 11:45:16AM +0200, Daniel Borkmann wrote: > On 05/13/2015 11:31 AM, Vadim Kochan wrote: > >On Wed, May 13, 2015 at 11:24:11AM +0200, Daniel Borkmann wrote: > >>On 05/13/2015 11:21 AM, Vadim Kochan wrote: > >>... > >>>Or in case of Netlink link type enforce to use netsniff-ng pcap format > >>>... > >> > >>I think that would be rather unexpected as other tools like Wireshark > >>cannot deal with that afaik. In that case, I rather prefer your patch > >>here. > > > >Then the patch should be re-worked a little to use cooked header only > >for default & nsec header formats, which I forgot to add in > > > > pcap_pkthdr_has_ll func ... > > > > Ok, so changing defaults, I would like to avoid actually as it could > potentially break things like Security Onion and others that rely on Well currently Netlink capture pcap file is broken by default as it does not make sense while identifying Netlink family protocol :-)
> the current capturing format (if they use the default one). It would > also make the pcaps bigger for that case. > > Here would be my suggestion on how to move forward: 1) add the cooked > header which is understood by tcpdump/wireshark as a new pcap type, 2) New magic number ? If yes then tcpdump/w-shark will not eat this .. > if we detect we're capturing on a netlink(/nlmon) device, use that as In the patch I already check this ... > a default there (I don't think there are many people relying on this > in netlink case), and 3) add a command-line option f.e. --cooked that > would make it easy to use as a shortcut for --magic XYZ. > > What do you think? > > Thanks, > Daniel -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
