On Tue, Jun 09, 2015 at 12:38:53AM +0200, Daniel Borkmann wrote: > On 06/04/2015 03:02 PM, Vadim Kochan wrote: > ... > >It needs some more additional changes to make compatibility with W-shark > >because W-shark wraps "cooked" header on top of network header (it uses > >DGRAM socket packet) but not on the mac header, so for netsniff-ng it > >needs to add separated dissector for LINKTYPE_LINUX_SLL which will find > >correct network protocol to dissect. > > Sorry for the late reply (on vacation currently). Me being a bit confused, > so you're saying that with your updated version of the patch, Wireshark cannot > read captured pcaps either as it expects them in a different format? Or, are > you rather saying netsniff-ng cannot read Wireshark captured pcaps? > > Thanks, > Daniel
I did these changes only locally to make possible to wrap just each frame with cooked header with new option (--cooked), and seems I was wrong because as I now understand W-shark uses PF dgram socket when it listens on any interface, and with dgram socket W-shark receives frames with pulled MAC header and wraps them (on top of network header) with SLL (cooked) header. But with current sent patch it dissects nlmsg frames OK. Sorry for confusing and seems I did not investigate this case more deeply. This is all about wrapping any frame. Regards, -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
