From: Vadim Kochan <[email protected]>
This series adds supporting of Linux "cooked" header
http://www.tcpdump.org/linktypes/LINKTYPE_NETLINK.html
which is compatible with Wireshark. Also it can be dissected by new
dissector_sll.c while dumping.
Needs to test on archs's with different byte ordering.
1) Add suporting Linux "cooked" header.
Added -w,--cooked option which replaces L2 header frame with cooked
header for each frame and allows to dump & dissect Ethernet & Netlink
packets together.
Linux "cooked" header is automatically used for Netlink link type
for the other cases (for -i any) it needs to specify "--cooked" option.
Used dgram packet socket when sniffing with "--cooked" option
to pull L2 header and wrap packet with Linux "cooked" header, it allows
compatibility with Wireshark.
2) Added dissector_sll.c to dissect packets with Linux "cooked" header.
Meanwhile it can dump only Netlink & Ethernet protos (L3 layer). This
dissector is used if link type is LINKTYPE_LINUX_SLL.
Vadim Kochan (2):
netsniff-ng: Add support of Linux "cooked" header
netsniff-ng: Add dissector for Linux "cooked" packets
dev.c | 2 +-
dev.h | 4 +-
dissector.c | 12 +-
dissector.h | 2 +-
dissector_sll.c | 113 ++++++++++++++
dissector_sll.h | 18 +++
linktype.h | 1 +
netsniff-ng.8 | 12 +-
netsniff-ng.c | 36 ++++-
netsniff-ng/Makefile | 1 +
pcap_io.h | 409 ++++++++++++++++++++++++++++++++-------------------
pcap_mm.c | 5 +-
pcap_rw.c | 4 +-
pcap_sg.c | 8 +-
pkt_buff.h | 2 +-
proto_nlmsg.c | 4 +-
sock.c | 10 ++
sock.h | 1 +
18 files changed, 466 insertions(+), 178 deletions(-)
create mode 100644 dissector_sll.c
create mode 100644 dissector_sll.h
--
2.4.2
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
