On Mon, Jun 01, 2015 at 02:09:39AM +0200, Daniel Borkmann wrote: > On 05/22/2015 04:45 PM, Vadim Kochan wrote: > >Use pcap cooked header for Netlink messages as described here: > > > > http://www.tcpdump.org/linktypes/LINKTYPE_NETLINK.html > > > >Signed-off-by: Vadim Kochan <[email protected]> > >--- > >RFC -> PATCH: > > 1) Add some clarifications about pcap cooked header in > > netsniff-ng.8 man page. > > > > 2) Consider pcap type when checking if pcap cooked header > > is needed in pcap_pkthdr_has_ll(...) func. > > > > 3) Fix wrong sll_protocol converting in pcap file. Removed > > converting to big endian in sockaddr_to_pcap_ll(...) func. > ... > > Thanks Vadim for the follow-up! One question below: > > ... > >+static inline void pcap_pkthdr_init(pcap_pkthdr_t *phdr, uint32_t link_type) > >+{ > >+ phdr->link_type = link_type; > > } > > Does this assumption still hold when you capture on i.e. '--in any' device, > and you have mixed data from Ethernet and Netlink combination to the same > pcap file? > > > #define FEATURE_UNKNOWN (0 << 0) > ...
Hi, I checked that in this case Ethernet & Netlink frames will be mixed in the pcap file, but netsniff-ng tries to identify all the frames as Ethernet, and in this case frames is not wrapped with cooked header. Regards, -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
