DLT_ATM_RFC1483 link-layer length ?

[Hannes Gredler <hannes () juniper net>]

hi,

where is actually the link-layer of an linktype defined ?

i was under the impression that libpcap/gencode.c
carries those information;

i.e.

---
        case DLT_ATM_RFC1483:
        case DLT_ATM_CLIP:      /* Linux ATM defines this */
                /*
                 * assume routed, non-ISO PDUs
                 * (i.e., LLC = 0xAA-AA-03, OUT = 0x00-00-00)
                 */
                off_linktype = 0;
                off_nl = 8;             /* 802.2+SNAP */
                off_nl_nosnap = 3;      /* 802.2 */
                return;
---

however as shown below tcpdump output insists on a 20-byte linkheader
for an LLC encapsulated frame [0606 is the LLCSAP_IP]

./tcpdump -n -e -x -r bootp.tcpdump

[ ... ]
12:28:00.323043 606000045000148 263a0000ff11946b 
                         ffff ffff 0044 0043 0134 0000 0101 0600
                         0000 263a 006e 0000 0000 0000 0000 0000
                         0000 0000 0000 0000 0800 0625 ec2a 0000
                         0000 0000 0000 0000 0000 0000 0000 0000
                         0000 0000 0000 0000 0000 0000 0000 0000
                         0000 0000 0000 0000 0000 0000 0000 0000
                         0000 0000 0000 0000 0000 0000 0000 0000
                         0000 0000 0000 0000 0000 0000 0000 0000
                         [ ... ]

any ideas ?

/hannes

Attachment: bootp.tcpdump
Description: