On 06/19/2015 11:48 PM, Vadim Kochan wrote:
On Fri, Jun 19, 2015 at 11:13:54PM +0200, Daniel Borkmann wrote:
On 06/19/2015 10:58 PM, Vadim Kochan wrote:
On Fri, Jun 19, 2015 at 10:47:49PM +0200, Daniel Borkmann wrote:
...
@@ -737,6 +837,24 @@ static inline void pcap_validate_header(const struct
pcap_filehdr *hdr)
if (unlikely(hdr->version_minor != PCAP_VERSION_MINOR) &&
___constant_swab16(hdr->version_minor) !=
PCAP_VERSION_MINOR)
panic("This file has an invalid pcap minor version (must be
%d)\n", PCAP_VERSION_MINOR);
+
+ /* Remap to internal *_LL types in case of LINKTYPE_LINUX_SLL. */
+ if (linktype == LINKTYPE_LINUX_SLL) {
should not link_has_sll_hdr() be used here ?
Why? At this point, when reading a pcap file, basic validation has already
been done and linktype is in host endianess. In netsniff-ng, we write out
the pcap header as LINKTYPE_LINUX_SLL in case of Netlink.
In case some other source doesn't use LINKTYPE_LINUX_SLL but LINKTYPE_NETLINK,
we actually need not to assume cooked format.
.
My understanding is that linktype might be set to LINKTYPE_NETLINK if it
was sniffed only from Netlink interface which uses the same sll header
format but with ignoring few fields - address & address len.
You mean from Wireshark? That it sets LINKTYPE_NETLINK in the pcap header,
although it has an LINKTYPE_LINUX_SLL-header in front of netlink dgrams?
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
