Note, by the way, that, for memory-mapped captures, the Linux kernel appears,
in tpacket_rcv(), to reserve 16 octets of extra space, which is exactly enough
to insert a DLT_LINUX_SLL header, but not enough for a DLT_LINUX_SLL2 header
(and wouldn't even be enough if we *didn't* pad it to put the interface index
on a 4-byte boundary):
if (sk->sk_type == SOCK_DGRAM) {
macoff = netoff = TPACKET_ALIGN(po->tp_hdrlen) + 16 +
po->tp_reserve;
} else {
unsigned int maclen = skb_network_offset(skb);
netoff = TPACKET_ALIGN(po->tp_hdrlen +
(maclen < 16 ? 16 : maclen)) +
po->tp_reserve;
macoff = netoff - maclen;
}
so to support LINKTYPE_LINUX_SLL2 you'd have to add 4 bytes to the tp_reserve
value, which is done with the PACKET_RESERVE, and that's not supported on all
kernels, so, in order to decide whether to support DLT_LINUX_SLL2, you have to
check whether you can do PACKET_RESERVE or not.
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
