tcpdump mailing list archives
Re: [PATCH] libpcap: Add datalink-type to match
From: Luca Bruno <lucab () debian org>
Date: Thu, 15 Apr 2010 23:00:51 +0200
Guy Harris scrisse:
From what you said there, it sounds as if Linux doesn't, in this case, engage in the link-layer-header-mangling it all too often does, and just hands a perfectly ordinary 802.15.4 header followed immediately by the payload to the socket, so it sounds as if DLT_IEEE802_15_4 is the right choice. My concern was that somebody *else* doing 802.15.4 on Linux wanted a different header:
[...]
In other words, the packets are *NOT* 802.15.4-2006 packets as they appear on the air, but have had the address fields padded?YesIs this on Linux?Yes it is on Linux. ( X86 and uClinunx ARM ). At the Moment i try to get the device driver (cc2420 at the Parallel Port on PC, SPI on ARM ) reliable. -although it sounds as if his 802.15.4 implementation might be different from the one in the mainstream kernel, and the latter might not pad the address fields.
Oh well, then it's a difficult story. I'm not using Linux drivers (as in, I've no devices attached locally) but merely getting properly remote 802.15.4 traffic on an aggregated interface on Linux. On one hand, you're right being concerned, as I just checked and it seems to be defined as such: include/net/af_ieee802154.h:37: #define IEEE802154_ADDR_LEN 8 include/net/af_ieee802154.h:43: u8 hwaddr [IEEE802154_ADDR_LEN]; so well, in that case they're not going to match, and I'm definitely wrong. On the other hand, I've standard-defined traffic which is what I (and wireshark, and everybody else) would expect on a IEEE802154 link here. I am not allowed to modify the packets (as they are, well, specification compliant) but still need to correctly handle, inspect, sniff from there and pcap-save them. If you're right and this patch isn't correct, how can I properly address that? Cheers, Luca -- .''`. ** Debian GNU/Linux ** | Luca Bruno (kaeso) : :' : The Universal O.S. | lucab (AT) debian.org `. `'` | GPG Key ID: 3BFB9FB3 `- http://www.debian.org | Debian GNU/Linux Developer
Attachment:
_bin
Description:
Current thread:
- [PATCH] libpcap: Add datalink-type to match IEEE 802.15.4 ARP hardware type Luca Bruno (Apr 08)
- Re: [PATCH] libpcap: Add datalink-type to match IEEE 802.15.4 ARP hardware type Guy Harris (Apr 15)
- Re: [PATCH] libpcap: Add datalink-type to match Luca Bruno (Apr 15)
- Re: [PATCH] libpcap: Add datalink-type to match Guy Harris (Apr 15)
- Re: [PATCH] libpcap: Add datalink-type to match Luca Bruno (Apr 15)
- Re: [PATCH] libpcap: Add datalink-type to match Luca Bruno (Apr 15)
- Re: [PATCH] libpcap: Add datalink-type to match IEEE 802.15.4 ARP hardware type Guy Harris (Apr 15)