Re: Patch to add DLT_AX25 handling to libpcap

[Richard Stearn <richard () rns-stearn demon co uk>]

Guy Harris wrote:
> Richard Stearn wrote:
>
> > +     case DLT_AX25:
> > +         /*
> > +          * Currently, only raw "link[N:M]" filtering is supported.
> > +          */
> > +         off_linktype = -1;    /* variable, min 15, max 71 steps of 7 */
> > +         off_nl = -1;        /* variable, min 16, max 71 steps of 7 */
> > +         off_nl_nosnap = -1;    /* no 802.2 LLC */
> > +         off_mac = 1;        /* step over the kiss length byte */
>
>
> Is the "kiss length byte" part of the AX.25 specification at
>
>     http://www.tapr.org/pdf/AX25.2.2.pdf

Guy

No, it is present on the front of packets arriving from an external
hardware Terminal Node Controllers or for compatability is added by the
Linux ax25 hardware drivers.

I was not sure how to formally handle it so opted to set the the MAC offset
to point to the first element of the protocol, the destination address.

What the implementors of AX.25 on Linux have done is to hand an KISS
packet rather than a pure AX.25 packet to the protocol stack.  This
probably was to accomodate the existing base of hardware where packets
were delivered to the system via an async serial port and the length of
the data is prepended.

The tcpdump print-ax25 & wireshark packet-ax25 AX.25 handlers I have written
are aware of the KISS length field.

--
Regards
        Richard

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.