--- ttt-1.8/net_read.c	2003-10-16 13:55:18.000000000 +0200
+++ ttt-1.8/net_read.c.new	2004-02-09 19:40:31.000000000 +0100
@@ -172,6 +172,10 @@
 static void pflog_if_read(u_char *user, const struct pcap_pkthdr *h,
 			  const u_char *p);
 #endif
+#ifdef DLT_LINUX_SLL	/* linux specific */
+static void linux_sll_if_read(u_char *user, const struct pcap_pkthdr *h,
+				const u_char *p);
+#endif
 static int ether_encap_read(u_short ethtype, const u_char *p,
 			    int length, int caplen);
 static int llc_read(const u_char *p, const int length, const int caplen);
@@ -664,6 +668,55 @@
 }
 #endif
 
+#ifdef DLT_LINUX_SLL
+
+#define SLL_HEADER_SIZE 16
+#define SLL_ADDRLEN     8               /* length of address field */
+
+struct sll_header {
+        u_int16_t       sll_pkttype;    /* packet type */
+        u_int16_t       sll_hatype;     /* link-layer address type */
+        u_int16_t       sll_halen;      /* link-layer address length */
+        u_int8_t        sll_addr[SLL_ADDRLEN];  /* link-layer address */
+        u_int16_t       sll_protocol;   /* protocol */
+};
+
+#define LINUX_SLL_P_802_2       0x0004
+
+static void 
+linux_sll_if_read(u_char *user, const struct pcap_pkthdr *h, const u_char *p)
+{
+        int caplen = h->caplen;
+        int length = h->len;
+        struct sll_header *hdr = (struct sll_header *)p;
+        int protocol;
+
+        packet_length = length;  /* save data link level packet length */
+        if (caplen < SLL_HEADER_SIZE) {
+                return;
+        }
+
+        p += SLL_HEADER_SIZE;
+        length -= SLL_HEADER_SIZE;
+        caplen -= SLL_HEADER_SIZE;
+
+        protocol = ntohs(hdr->sll_protocol);
+
+        if (protocol <= 1536) {
+
+                switch (protocol) {
+
+                case LINUX_SLL_P_802_2:
+                        llc_read(p, length, caplen);
+                        break;
+
+                }
+        } else
+                ether_encap_read(protocol, p, length, caplen);
+}
+
+#endif
+
 #ifdef PFLOG_HDRLEN
 
 static void
@@ -1094,6 +1147,9 @@
 #ifdef PFLOG_HDRLEN
 	{ pflog_if_read,	DLT_PFLOG },
 #endif
+#ifdef DLT_LINUX_SLL
+	{ linux_sll_if_read,	DLT_LINUX_SLL },
+#endif
 	{ NULL,			0 },
 };