On Tue, Jun 09, 2015 at 01:47:03AM +0300, Vadim Kochan wrote: > On Tue, Jun 09, 2015 at 12:38:53AM +0200, Daniel Borkmann wrote: > > On 06/04/2015 03:02 PM, Vadim Kochan wrote: > > ... > > >It needs some more additional changes to make compatibility with W-shark > > >because W-shark wraps "cooked" header on top of network header (it uses > > >DGRAM socket packet) but not on the mac header, so for netsniff-ng it > > >needs to add separated dissector for LINKTYPE_LINUX_SLL which will find > > >correct network protocol to dissect. > > > > Sorry for the late reply (on vacation currently). Me being a bit confused, > > so you're saying that with your updated version of the patch, Wireshark > > cannot > > read captured pcaps either as it expects them in a different format? Or, are > > you rather saying netsniff-ng cannot read Wireshark captured pcaps? > > > > Thanks, > > Daniel > > I did these changes only locally to make possible to wrap just each frame > with cooked header with new option (--cooked), and seems I was wrong > because as I now understand W-shark uses PF dgram socket when it listens > on any interface, and with dgram socket W-shark receives frames with pulled > MAC header and wraps them (on top of network header) with SLL (cooked) > header. > > But with current sent patch it dissects nlmsg frames OK. > > Sorry for confusing and seems I did not investigate this case more > deeply. > > This is all about wrapping any frame. > > Regards,
OK, I am very close to finish the "cooked" support with W-shark compatibility, need 1-2 days to make sure everything works OK. Meanwhile I have new dissector which uses sockaddr_ll->sll_protocol to find netlink or ether dissector, by sockaddr_ll info. This dissector is selected by new LINKTYPE_LINUX_SLL link_type value. Also I use socket DGRAM for sniffing packets when "--cooked" option was specified, so the frames will have automatically pulled L2 header. Currently netsniff-ng & W-shark understands each other's sniffed "cooked" frames. But ... the diff is really bigger, I am not sure if I can split it to smaller logical parts. I am really hope there will be no any conflicts. Regards, Vadim Kochan -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
