1de0d3203SPeter Avalos /*- 2de0d3203SPeter Avalos * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 3de0d3203SPeter Avalos * The Regents of the University of California. All rights reserved. 4de0d3203SPeter Avalos * 5de0d3203SPeter Avalos * This code is derived from the Stanford/CMU enet packet filter, 6de0d3203SPeter Avalos * (net/enet.c) distributed as part of 4.3BSD, and code contributed 7de0d3203SPeter Avalos * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence 8de0d3203SPeter Avalos * Berkeley Laboratory. 9de0d3203SPeter Avalos * 10de0d3203SPeter Avalos * Redistribution and use in source and binary forms, with or without 11de0d3203SPeter Avalos * modification, are permitted provided that the following conditions 12de0d3203SPeter Avalos * are met: 13de0d3203SPeter Avalos * 1. Redistributions of source code must retain the above copyright 14de0d3203SPeter Avalos * notice, this list of conditions and the following disclaimer. 15de0d3203SPeter Avalos * 2. Redistributions in binary form must reproduce the above copyright 16de0d3203SPeter Avalos * notice, this list of conditions and the following disclaimer in the 17de0d3203SPeter Avalos * documentation and/or other materials provided with the distribution. 18de0d3203SPeter Avalos * 3. All advertising materials mentioning features or use of this software 19de0d3203SPeter Avalos * must display the following acknowledgement: 20de0d3203SPeter Avalos * This product includes software developed by the University of 21de0d3203SPeter Avalos * California, Berkeley and its contributors. 22de0d3203SPeter Avalos * 4. Neither the name of the University nor the names of its contributors 23de0d3203SPeter Avalos * may be used to endorse or promote products derived from this software 24de0d3203SPeter Avalos * without specific prior written permission. 25de0d3203SPeter Avalos * 26de0d3203SPeter Avalos * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 27de0d3203SPeter Avalos * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 28de0d3203SPeter Avalos * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 29de0d3203SPeter Avalos * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 30de0d3203SPeter Avalos * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31de0d3203SPeter Avalos * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32de0d3203SPeter Avalos * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33de0d3203SPeter Avalos * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34de0d3203SPeter Avalos * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35de0d3203SPeter Avalos * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36de0d3203SPeter Avalos * SUCH DAMAGE. 37de0d3203SPeter Avalos */ 38de0d3203SPeter Avalos 39de0d3203SPeter Avalos /* 40de0d3203SPeter Avalos * For captures on Linux cooked sockets, we construct a fake header 41de0d3203SPeter Avalos * that includes: 42de0d3203SPeter Avalos * 43de0d3203SPeter Avalos * a 2-byte "packet type" which is one of: 44de0d3203SPeter Avalos * 45de0d3203SPeter Avalos * LINUX_SLL_HOST packet was sent to us 46de0d3203SPeter Avalos * LINUX_SLL_BROADCAST packet was broadcast 47de0d3203SPeter Avalos * LINUX_SLL_MULTICAST packet was multicast 48de0d3203SPeter Avalos * LINUX_SLL_OTHERHOST packet was sent to somebody else 49de0d3203SPeter Avalos * LINUX_SLL_OUTGOING packet was sent *by* us; 50de0d3203SPeter Avalos * 51de0d3203SPeter Avalos * a 2-byte Ethernet protocol field; 52de0d3203SPeter Avalos * 53de0d3203SPeter Avalos * a 2-byte link-layer type; 54de0d3203SPeter Avalos * 55de0d3203SPeter Avalos * a 2-byte link-layer address length; 56de0d3203SPeter Avalos * 57de0d3203SPeter Avalos * an 8-byte source link-layer address, whose actual length is 58de0d3203SPeter Avalos * specified by the previous value. 59de0d3203SPeter Avalos * 60de0d3203SPeter Avalos * All fields except for the link-layer address are in network byte order. 61de0d3203SPeter Avalos * 62de0d3203SPeter Avalos * DO NOT change the layout of this structure, or change any of the 63de0d3203SPeter Avalos * LINUX_SLL_ values below. If you must change the link-layer header 64de0d3203SPeter Avalos * for a "cooked" Linux capture, introduce a new DLT_ type (ask 65de0d3203SPeter Avalos * "tcpdump-workers@lists.tcpdump.org" for one, so that you don't give it 66de0d3203SPeter Avalos * a value that collides with a value already being used), and use the 67de0d3203SPeter Avalos * new header in captures of that type, so that programs that can 68de0d3203SPeter Avalos * handle DLT_LINUX_SLL captures will continue to handle them correctly 69de0d3203SPeter Avalos * without any change, and so that capture files with different headers 70de0d3203SPeter Avalos * can be told apart and programs that read them can dissect the 71de0d3203SPeter Avalos * packets in them. 72de0d3203SPeter Avalos */ 73de0d3203SPeter Avalos 74de0d3203SPeter Avalos #ifndef lib_pcap_sll_h 75de0d3203SPeter Avalos #define lib_pcap_sll_h 76de0d3203SPeter Avalos 77*3a289941SAaron LI #include <pcap/pcap-inttypes.h> 78*3a289941SAaron LI 79de0d3203SPeter Avalos /* 80de0d3203SPeter Avalos * A DLT_LINUX_SLL fake link-layer header. 81de0d3203SPeter Avalos */ 82de0d3203SPeter Avalos #define SLL_HDR_LEN 16 /* total header length */ 83de0d3203SPeter Avalos #define SLL_ADDRLEN 8 /* length of address field */ 84de0d3203SPeter Avalos 85de0d3203SPeter Avalos struct sll_header { 86*3a289941SAaron LI uint16_t sll_pkttype; /* packet type */ 87*3a289941SAaron LI uint16_t sll_hatype; /* link-layer address type */ 88*3a289941SAaron LI uint16_t sll_halen; /* link-layer address length */ 89*3a289941SAaron LI uint8_t sll_addr[SLL_ADDRLEN]; /* link-layer address */ 90*3a289941SAaron LI uint16_t sll_protocol; /* protocol */ 91de0d3203SPeter Avalos }; 92de0d3203SPeter Avalos 93de0d3203SPeter Avalos /* 94*3a289941SAaron LI * A DLT_LINUX_SLL2 fake link-layer header. 95*3a289941SAaron LI */ 96*3a289941SAaron LI #define SLL2_HDR_LEN 20 /* total header length */ 97*3a289941SAaron LI 98*3a289941SAaron LI struct sll2_header { 99*3a289941SAaron LI uint16_t sll2_protocol; /* protocol */ 100*3a289941SAaron LI uint16_t sll2_reserved_mbz; /* reserved - must be zero */ 101*3a289941SAaron LI uint32_t sll2_if_index; /* 1-based interface index */ 102*3a289941SAaron LI uint16_t sll2_hatype; /* link-layer address type */ 103*3a289941SAaron LI uint8_t sll2_pkttype; /* packet type */ 104*3a289941SAaron LI uint8_t sll2_halen; /* link-layer address length */ 105*3a289941SAaron LI uint8_t sll2_addr[SLL_ADDRLEN]; /* link-layer address */ 106*3a289941SAaron LI }; 107*3a289941SAaron LI 108*3a289941SAaron LI /* 109*3a289941SAaron LI * The LINUX_SLL_ values for "sll_pkttype" and LINUX_SLL2_ values for 110*3a289941SAaron LI * "sll2_pkttype"; these correspond to the PACKET_ values on Linux, 111*3a289941SAaron LI * which are defined by a header under include/uapi in the current 112*3a289941SAaron LI * kernel source, and are thus not going to change on Linux. We 113*3a289941SAaron LI * define them here so that they're available even on systems other 114*3a289941SAaron LI * than Linux. 115de0d3203SPeter Avalos */ 116de0d3203SPeter Avalos #define LINUX_SLL_HOST 0 117de0d3203SPeter Avalos #define LINUX_SLL_BROADCAST 1 118de0d3203SPeter Avalos #define LINUX_SLL_MULTICAST 2 119de0d3203SPeter Avalos #define LINUX_SLL_OTHERHOST 3 120de0d3203SPeter Avalos #define LINUX_SLL_OUTGOING 4 121de0d3203SPeter Avalos 122de0d3203SPeter Avalos /* 123*3a289941SAaron LI * The LINUX_SLL_ values for "sll_protocol" and LINUX_SLL2_ values for 124*3a289941SAaron LI * "sll2_protocol"; these correspond to the ETH_P_ values on Linux, but 125*3a289941SAaron LI * are defined here so that they're available even on systems other than 126*3a289941SAaron LI * Linux. We assume, for now, that the ETH_P_ values won't change in 127*3a289941SAaron LI * Linux; if they do, then: 128de0d3203SPeter Avalos * 129de0d3203SPeter Avalos * if we don't translate them in "pcap-linux.c", capture files 130de0d3203SPeter Avalos * won't necessarily be readable if captured on a system that 131de0d3203SPeter Avalos * defines ETH_P_ values that don't match these values; 132de0d3203SPeter Avalos * 133de0d3203SPeter Avalos * if we do translate them in "pcap-linux.c", that makes life 134de0d3203SPeter Avalos * unpleasant for the BPF code generator, as the values you test 135de0d3203SPeter Avalos * for in the kernel aren't the values that you test for when 136de0d3203SPeter Avalos * reading a capture file, so the fixup code run on BPF programs 137de0d3203SPeter Avalos * handed to the kernel ends up having to do more work. 138de0d3203SPeter Avalos * 139de0d3203SPeter Avalos * Add other values here as necessary, for handling packet types that 140de0d3203SPeter Avalos * might show up on non-Ethernet, non-802.x networks. (Not all the ones 141de0d3203SPeter Avalos * in the Linux "if_ether.h" will, I suspect, actually show up in 142de0d3203SPeter Avalos * captures.) 143de0d3203SPeter Avalos */ 144de0d3203SPeter Avalos #define LINUX_SLL_P_802_3 0x0001 /* Novell 802.3 frames without 802.2 LLC header */ 145de0d3203SPeter Avalos #define LINUX_SLL_P_802_2 0x0004 /* 802.2 frames (not D/I/X Ethernet) */ 14697a9217aSAntonio Huete Jimenez #define LINUX_SLL_P_CAN 0x000C /* CAN frames, with SocketCAN pseudo-headers */ 14797a9217aSAntonio Huete Jimenez #define LINUX_SLL_P_CANFD 0x000D /* CAN FD frames, with SocketCAN pseudo-headers */ 148de0d3203SPeter Avalos 149de0d3203SPeter Avalos #endif 150