--- ttt-1.8/net_read.c 2003-10-16 13:55:18.000000000 +0200 +++ ttt-1.8/net_read.c.new 2004-02-09 19:40:31.000000000 +0100 @@ -172,6 +172,10 @@ static void pflog_if_read(u_char *user, const struct pcap_pkthdr *h, const u_char *p); #endif +#ifdef DLT_LINUX_SLL /* linux specific */ +static void linux_sll_if_read(u_char *user, const struct pcap_pkthdr *h, + const u_char *p); +#endif static int ether_encap_read(u_short ethtype, const u_char *p, int length, int caplen); static int llc_read(const u_char *p, const int length, const int caplen); @@ -664,6 +668,55 @@ } #endif +#ifdef DLT_LINUX_SLL + +#define SLL_HEADER_SIZE 16 +#define SLL_ADDRLEN 8 /* length of address field */ + +struct sll_header { + u_int16_t sll_pkttype; /* packet type */ + u_int16_t sll_hatype; /* link-layer address type */ + u_int16_t sll_halen; /* link-layer address length */ + u_int8_t sll_addr[SLL_ADDRLEN]; /* link-layer address */ + u_int16_t sll_protocol; /* protocol */ +}; + +#define LINUX_SLL_P_802_2 0x0004 + +static void +linux_sll_if_read(u_char *user, const struct pcap_pkthdr *h, const u_char *p) +{ + int caplen = h->caplen; + int length = h->len; + struct sll_header *hdr = (struct sll_header *)p; + int protocol; + + packet_length = length; /* save data link level packet length */ + if (caplen < SLL_HEADER_SIZE) { + return; + } + + p += SLL_HEADER_SIZE; + length -= SLL_HEADER_SIZE; + caplen -= SLL_HEADER_SIZE; + + protocol = ntohs(hdr->sll_protocol); + + if (protocol <= 1536) { + + switch (protocol) { + + case LINUX_SLL_P_802_2: + llc_read(p, length, caplen); + break; + + } + } else + ether_encap_read(protocol, p, length, caplen); +} + +#endif + #ifdef PFLOG_HDRLEN static void @@ -1094,6 +1147,9 @@ #ifdef PFLOG_HDRLEN { pflog_if_read, DLT_PFLOG }, #endif +#ifdef DLT_LINUX_SLL + { linux_sll_if_read, DLT_LINUX_SLL }, +#endif { NULL, 0 }, };