Re: Linux input layer evdev capturing

[Guy Harris <guy () alum mit edu>]

On Nov 8, 2008, at 7:05 PM, David Gibson wrote:

> I have a work-in-progress patch to allow libpcap to capture events
> from the Linux input layer's "evdev" interface (/dev/input/event*).
> Later I plan to add a wireshark dissector for the packet format.
>
> First, does this seem like a reasonable feature to add to libpcap?

At this point, I'd say that anything that could be considered  
"packets" would be reasonable for libpcap (if this were the early-to- 
mid 80's, I could see MSCP support in libpcap, for example); we  
already have input sources that aren't traditional "networks".  (And I  
wonder whether, just as there's the saying that all applications  
eventually evolve to the point where you can use them as mail user  
agents, it might be the case all protocols evolve to the point that  
they eventually transport IP or are transported over IP....)

> Second, if it is, I gather this is the place to ask for a DLT_ value
> for this..

The name evdev is, as far as I know, a Linuxism, so DLT_EVDEV might  
suffice as a name, unless fill-in-the-blankBSD or Solaris or... ends  
up doing their own input layer with a different packet format and  
calling it evdev, although in that case we could have  
DLT_FREEBSD_EVDEV or DLT_NETBSD_EVDEV or....

Any objections to just DLT_EVDEV?

> David Gibson                    | I'll have my music baroque, and my code
> david AT gibson.dropbear.id.au	| minimalist, thank you.  NOT _the_  
> _other_
>                                 | _way_ _around_!

"Knock, knock."

"Who's there?"

"Philip Glass."

"Philip Glass who?"

"Knock, knock."

...

(Heck, a version of that is even on the Philip Glass Web site:

        http://www.philipglass.com/html/pages/jokes.html

.)
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.