The problem - as I eluded to in my other reply - is that the DLT_ type is 12, raw.
And while the implementation of RAW for a tun device is a headless Ethernet frame, that's not a valid assumption about RAW in general. What can be done is to store the values (instead of using the lookup table with it's implied array lookup) and disable suspicious packet capture based on MTU if we can't be sure of it. I'll send you the patch directly when I get it code up, but it's going to need to be tested! -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Julien TOUCHE Sent: Friday, November 07, 2003 6:53 AM To: [EMAIL PROTECTED] Subject: Re: [Ntop] Unknown DLT types > If you can figure out the data link level header length and the associated > DLT code, you can try adding them to the table in globals-core.c at 380ff: > > _mtuSize[DLT_NULL] = 8232 /* no > link-layer encapsulation */; > _headerSize[DLT_NULL] = CONST_NULL_HDRLEN; > > /* 1500 + 14 bytes header Courtesy of Andreas Pfaller > <[EMAIL PROTECTED]> */ > _mtuSize[DLT_EN10MB] = 1500+sizeof(struct ether_header) /* Ethernet > (10Mb) */; > _headerSize[DLT_EN10MB] = sizeof(struct ether_header); > ... > tun device i used (openvpn) must have same ethernet header as normal ones. i can get mtu from `ifconfig -a` and it depends (have 1500 and 1255, sit1 is 1480). for header size, i will ask on openvpn mailing-list. last interface is sit1 (ipv6 tunnel), but it doesn't matter for now (as far as i'm concerned). Regards Julien _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
