1 /*- 2 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 3 * The Regents of the University of California. All rights reserved. 4 * 5 * This code is derived from the Stanford/CMU enet packet filter, 6 * (net/enet.c) distributed as part of 4.3BSD, and code contributed 7 * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence 8 * Berkeley Laboratory. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 3. All advertising materials mentioning features or use of this software 19 * must display the following acknowledgement: 20 * This product includes software developed by the University of 21 * California, Berkeley and its contributors. 22 * 4. Neither the name of the University nor the names of its contributors 23 * may be used to endorse or promote products derived from this software 24 * without specific prior written permission. 25 * 26 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 29 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 * 38 */ 39 40 /* 41 * $Id: //depot/argus/argus/include/argus/sll.h#2 $ 42 * $DateTime: 2011/01/26 17:16:43 $ 43 * $Change: 2088 $ 44 */ 45 46 #if !defined(sll_h) 47 #define sll_h 48 49 /* 50 * For captures on Linux cooked sockets, we construct a fake header 51 * that includes: 52 * 53 * a 2-byte "packet type" which is one of: 54 * 55 * LINUX_SLL_HOST packet was sent to us 56 * LINUX_SLL_BROADCAST packet was broadcast 57 * LINUX_SLL_MULTICAST packet was multicast 58 * LINUX_SLL_OTHERHOST packet was sent to somebody else 59 * LINUX_SLL_OUTGOING packet was sent *by* us; 60 * 61 * a 2-byte Ethernet protocol field; 62 * 63 * a 2-byte link-layer type; 64 * 65 * a 2-byte link-layer address length; 66 * 67 * an 8-byte source link-layer address, whose actual length is 68 * specified by the previous value. 69 * 70 * All fields except for the link-layer address are in network byte order. 71 * 72 * DO NOT change the layout of this structure, or change any of the 73 * LINUX_SLL_ values below. If you must change the link-layer header 74 * for a "cooked" Linux capture, introduce a new DLT_ type (ask 75 * "tcpdump-workers@tcpdump.org" for one, so that you don't give it a 76 * value that collides with a value already being used), and use the 77 * new header in captures of that type, so that programs that can 78 * handle DLT_LINUX_SLL captures will continue to handle them correctly 79 * without any change, and so that capture files with different headers 80 * can be told apart and programs that read them can dissect the 81 * packets in them. 82 * 83 * This structure, and the #defines below, must be the same in the 84 * libpcap and tcpdump versions of "sll.h". 85 */ 86 87 /* 88 * A DLT_LINUX_SLL fake link-layer header. 89 */ 90 #define SLL_HDR_LEN 16 /* total header length */ 91 #define SLL_ADDRLEN 8 /* length of address field */ 92 93 struct sll_header { 94 u_short sll_pkttype; /* packet type */ 95 u_short sll_hatype; /* link-layer address type */ 96 u_short sll_halen; /* link-layer address length */ 97 u_char sll_addr[SLL_ADDRLEN]; /* link-layer address */ 98 u_short sll_protocol; /* protocol */ 99 }; 100 101 /* 102 * The LINUX_SLL_ values for "sll_pkttype"; these correspond to the 103 * PACKET_ values on Linux, but are defined here so that they're 104 * available even on systems other than Linux, and so that they 105 * don't change even if the PACKET_ values change. 106 */ 107 #define LINUX_SLL_HOST 0 108 #define LINUX_SLL_BROADCAST 1 109 #define LINUX_SLL_MULTICAST 2 110 #define LINUX_SLL_OTHERHOST 3 111 #define LINUX_SLL_OUTGOING 4 112 113 /* 114 * The LINUX_SLL_ values for "sll_protocol"; these correspond to the 115 * ETH_P_ values on Linux, but are defined here so that they're 116 * available even on systems other than Linux. We assume, for now, 117 * that the ETH_P_ values won't change in Linux; if they do, then: 118 * 119 * if we don't translate them in "pcap-linux.c", capture files 120 * won't necessarily be readable if captured on a system that 121 * defines ETH_P_ values that don't match these values; 122 * 123 * if we do translate them in "pcap-linux.c", that makes life 124 * unpleasant for the BPF code generator, as the values you test 125 * for in the kernel aren't the values that you test for when 126 * reading a capture file, so the fixup code run on BPF programs 127 * handed to the kernel ends up having to do more work. 128 * 129 * Add other values here as necessary, for handling packet types that 130 * might show up on non-Ethernet, non-802.x networks. (Not all the ones 131 * in the Linux "if_ether.h" will, I suspect, actually show up in 132 * captures.) 133 */ 134 #define LINUX_SLL_P_802_3 0x0001 /* Novell 802.3 frames without 802.2 LLC header */ 135 #define LINUX_SLL_P_802_2 0x0004 /* 802.2 frames (not D/I/X Ethernet) */ 136 #endif 137