On Jul 12, 2018, at 11:02 AM, Petr Vorel <pvo...@suse.cz> wrote: > Unfortunately I haven't found a way how to coexist in runtime library > both LINKTYPE_LINUX_SLL and LINKTYPE_LINUX_SLL2,
See libpcap commit 8cff296dc7c321c76933359d586dbde5b580ce8c, which adds DLT_LINUX_SLL2/LINKTYPE_LINUX_SLL2 support. Both DLT_LINUX_SLL and DLT_LINUX_SLL2 are supported if the PACKET_RESERVE socket option is supported, with DLT_LINUX_SLL being, for now, the default. I have just checked in a tcpdump change, 51c1da63e40e046b6b4620edb1ac1ba8b2707182, to support DLT_LINUX_SLL2, although it currently makes no use of the interface index. Once Wireshark support for DLT_LINUX_SLL2 is also added, perhaps that's the time to make it the default, although choosing DLT_LINUX_SLL2 may make other programs that support DLT_LINUX_SLL but not DLT_LINUX_SLL2 unable to read captures. _______________________________________________ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
