Re: Patch to add DLT_AX25 handling to libpcap

[Guy Harris <guy () alum mit edu>]

Richard Stearn wrote:

> Adding DLT_AX25_KISS is the obvious way to go with the exception that Linux
> identifies AX.25 in KISS packets as DLT_AX25 (protocol 3).

"Identifies" in what sense?

I don't see any use of DLT_AX25 in the 2.6.20.4 kernel.  It appears to 
use ARPHRD_AX25 as the arphrd value for AX.25 adapters, and that happens 
to have the same value as DLT_AX25 because the first few DLT_ values 
were ARP hardware type values, but libpcap doesn't expose ARPHRD_ values 
to applications - it maps them to DLT_ values.

> The only viable alternative I see is to check for the platform, if Linux
> then apply the offset and mark the packet as DLT_AX25_KISS otherwise assume
> pure AX.25.  Not sure if this is practical in libpcap.

pcap-linux.c could map ARPHRD_AX25 to DLT_AX25_KISS, which means AX.25 
captures done on Linux will have a file type of DLT_AX25_KISS.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.