tcpdump mailing list archives

Re: [PATCH] libpcap: Add datalink-type to match


From: Luca Bruno <lucab () debian org>
Date: Thu, 15 Apr 2010 23:00:51 +0200

Guy Harris scrisse:

From what you said there, it sounds as if Linux doesn't, in this
case, engage in the link-layer-header-mangling it all too often does,
and just hands a perfectly ordinary 802.15.4 header followed
immediately by the payload to the socket, so it sounds as if
DLT_IEEE802_15_4 is the right choice.  My concern was that somebody
*else* doing 802.15.4 on Linux wanted a different header:

[...]

In other words, the packets are *NOT* 802.15.4-2006 packets as
they appear on the air, but have had the address fields padded?

Yes

Is this on Linux?

Yes it is on Linux. ( X86 and uClinunx ARM ). At the Moment i try
to get the device driver (cc2420 at the Parallel Port on PC, SPI on
ARM ) reliable. -

although it sounds as if his 802.15.4 implementation might be
different from the one in the mainstream kernel, and the latter might
not pad the address fields.

Oh well, then it's a difficult story. I'm not using Linux drivers (as
in, I've no devices attached locally) but merely getting properly
remote 802.15.4 traffic on an aggregated interface on Linux.
On one hand, you're right being concerned, as I just checked and it
seems to be defined as such:
include/net/af_ieee802154.h:37: #define IEEE802154_ADDR_LEN     8
include/net/af_ieee802154.h:43: u8 hwaddr [IEEE802154_ADDR_LEN];
so well, in that case they're not going to match, and I'm definitely wrong.
On the other hand, I've standard-defined traffic which is what I
(and wireshark, and everybody else) would expect on a IEEE802154 link here.
I am not allowed to modify the packets (as they are, well, specification
compliant) but still need to correctly handle, inspect, sniff from there
and pcap-save them. 
If you're right and this patch isn't correct, how can I properly address that?

Cheers, Luca

-- 
 .''`.  ** Debian GNU/Linux **  | Luca Bruno (kaeso)
: :'  :   The Universal O.S.    | lucab (AT) debian.org
`. `'`                          | GPG Key ID: 3BFB9FB3
  `-     http://www.debian.org  | Debian GNU/Linux Developer

Attachment: _bin
Description:


Current thread: