http://www.tcpdump.org/linktypes.html
contains a description of all the existing link-layer header types for which
there is either
1) an official standard;
2) a reasonably complete description;
3) a tcpdump or Wireshark dissector from which I could construct a
reasonably complete description;
as well as a mention of the USER0 through USER15 types. If the description
wasn't available elsewhere on the Web, or in a published standard, I created a
description page in the http://www.tcpdump.org/linktypes directory, and linked
to it.
The table of link-layer header type values gives:
the LINKTYPE_ name for the type - currently, that's only used inside
libpcap, and not exported, as there are no APIs to fetch it;
the value of that LINKTYPE_ name - that's what should be used in pcap
and pcap-ng capture files;
the corresponding DLT_ name - that's what's returned by the libpcap
APIs;
a description of the header.
The value for the DLT_ name is *NOT* given, as it may differ from platform to
platform; in most cases, it's the same as the LINKTYPE_ value, but, in a few
cases, a separate LINKTYPE_ value was assigned, in an attempt to cope with
different BPF-bearing systems choosing different numeric values for the same
DLT_ name.
It's linked to from the menu at the top of all pages.
I've checked in a change to the pcap-linktypes man page, in the libpcap trunk
and 1.1 branch, to just refer to the Web page rather than to enumerate the
link-layer header types. The descriptions in pcap/bpf.h should also migrate to
the linktypes.html page and subpages in the linktype directory.
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <[email protected]>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:[email protected]?subject=unsubscribe
