tcpdump mailing list archives

Re: two new link type request


From: Guy Harris <guy () alum mit edu>
Date: Wed, 3 Dec 2003 13:43:27 -0800


On Dec 1, 2003, at 11:25 AM, alex medvedev wrote:

hi,

On Mon, 1 Dec 2003, Guy Harris wrote:
On Mon, Dec 01, 2003 at 10:06:18AM -0600, alex medvedev wrote:
can we define two new link types for the IBM SP switch DLT_SP and for the
IBM Next Federation switch DLT_SN?

IBM defined them as IFT_SN 0x38 and IFT_SP 0x39 in
/usr/include/net/if_types.h

i can find out the off_nl and off_linktype values for them.

And the link-layer header format? (Is this something atop which you can
run protocols such as IP?  I infer so, given that they're in
if_types.h.)

these are physical interfaces, which you can run protocols on top of.

just got email back from IBM:

IBM> SP & Federation switch driver code is IBM proprietary and we
IBM> can not release the source code/header to outside world. Can
IBM> you still reserve 0x38 & 0x39 for us to use?

I've given them 145 and 146 (decimal, not hex) instead, as those were the next values available in the range we maintain.

If they want to use 0x38 and 0x39 in AIX tcpdump, they can - AIX tcpdump files are *NOT* standard libpcap files, as they *ALREADY* use IFT_ values rather than DLT_ values or LINKTYPE_ values in the file header (and store time stamps with nanosecond resolution), and IBM, not tcpdump.org, owns the link-layer-type number space for those files.

(If they're going to continue using their non-standard format, however, it would be greatly appreciated if they at least chose a different magic number for those files, so you don't need gross heuristics, such as the ones Ethereal uses, to figure out what type of file it is. The values 0xa1b2c3d4 and 0xa1b2cd34 are already taken; if they choose another one, it would be greatly appreciated if they told us what it was, so we could support it, and avoid using it for future capture file formats. If they choose a new magic number, they will, of course, render those files unreadable by older versions of their tcpdump.)

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe


Current thread: