1 /* $NetBSD: pcap-common.c,v 1.10 2026/03/18 23:43:20 christos Exp $ */ 2 3 /* 4 * Copyright (c) 1993, 1994, 1995, 1996, 1997 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that: (1) source code distributions 9 * retain the above copyright notice and this paragraph in its entirety, (2) 10 * distributions including binary code include the above copyright notice and 11 * this paragraph in its entirety in the documentation or other materials 12 * provided with the distribution, and (3) all advertising materials mentioning 13 * features or use of this software display the following acknowledgement: 14 * ``This product includes software developed by the University of California, 15 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 16 * the University nor the names of its contributors may be used to endorse 17 * or promote products derived from this software without specific prior 18 * written permission. 19 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 20 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 21 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 22 * 23 * pcap-common.c - common code for pcap and pcapng files 24 */ 25 26 #include <sys/cdefs.h> 27 __RCSID("$NetBSD: pcap-common.c,v 1.10 2026/03/18 23:43:20 christos Exp $"); 28 29 #include <config.h> 30 31 #include <pcap-types.h> 32 33 #include "pcap-int.h" 34 35 #include "pcap-common.h" 36 37 /* 38 * We don't write DLT_* values to capture files, because they're not the 39 * same on all platforms. 40 * 41 * Unfortunately, the various flavors of BSD have not always used the same 42 * numerical values for the same data types, and various patches to 43 * libpcap for non-BSD OSes have added their own DLT_* codes for link 44 * layer encapsulation types seen on those OSes, and those codes have had, 45 * in some cases, values that were also used, on other platforms, for other 46 * link layer encapsulation types. 47 * 48 * This means that capture files of a type whose numerical DLT_* code 49 * means different things on different BSDs, or with different versions 50 * of libpcap, can't always be read on systems other than those like 51 * the one running on the machine on which the capture was made. 52 * 53 * Instead, we define here a set of LINKTYPE_* codes, and map DLT_* codes 54 * to LINKTYPE_* codes when writing a savefile header, and map LINKTYPE_* 55 * codes to DLT_* codes when reading a savefile header. 56 * 57 * For those DLT_* codes that have, as far as we know, the same values on 58 * all platforms (DLT_NULL through DLT_FDDI), we define LINKTYPE_xxx as 59 * DLT_xxx; that way, captures of those types can still be read by 60 * versions of libpcap that map LINKTYPE_* values to DLT_* values, and 61 * captures of those types written by versions of libpcap that map DLT_ 62 * values to LINKTYPE_ values can still be read by older versions 63 * of libpcap. 64 * 65 * The other LINKTYPE_* codes are given values starting at 100, in the 66 * hopes that no DLT_* code will be given one of those values. 67 * 68 * In order to ensure that a given LINKTYPE_* code's value will refer to 69 * the same encapsulation type on all platforms, you should not allocate 70 * a new LINKTYPE_* value without consulting 71 * "tcpdump-workers (at) lists.tcpdump.org". The tcpdump developers will 72 * allocate a value for you, and will not subsequently allocate it to 73 * anybody else; that value will be added to the "pcap.h" in the 74 * tcpdump.org Git repository, so that a future libpcap release will 75 * include it. 76 * 77 * You should, if possible, also contribute patches to libpcap and tcpdump 78 * to handle the new encapsulation type, so that they can also be checked 79 * into the tcpdump.org Git repository and so that they will appear in 80 * future libpcap and tcpdump releases. 81 * 82 * Do *NOT* assume that any values after the largest value in this file 83 * are available; you might not have the most up-to-date version of this 84 * file, and new values after that one might have been assigned. Also, 85 * do *NOT* use any values below 100 - those might already have been 86 * taken by one (or more!) organizations. 87 * 88 * Any platform that defines additional DLT_* codes should: 89 * 90 * request a LINKTYPE_* code and value from tcpdump.org, 91 * as per the above; 92 * 93 * add, in their version of libpcap, an entry to map 94 * those DLT_* codes to the corresponding LINKTYPE_* 95 * code; 96 * 97 * redefine, in their "net/bpf.h", any DLT_* values 98 * that collide with the values used by their additional 99 * DLT_* codes, to remove those collisions (but without 100 * making them collide with any of the LINKTYPE_* 101 * values equal to 50 or above; they should also avoid 102 * defining DLT_* values that collide with those 103 * LINKTYPE_* values, either). 104 */ 105 106 /* 107 * These values the DLT_ values for which are the same on all platforms, 108 * and that have been defined by <net/bpf.h> for ages. 109 * 110 * For those, the LINKTYPE_ values are equal to the DLT_ values. 111 * 112 * LINKTYPE_LOW_MATCHING_MIN is the lowest such value; 113 * LINKTYPE_LOW_MATCHING_MAX is the highest such value. 114 */ 115 #define LINKTYPE_LOW_MATCHING_MIN 0 /* lowest value in this "matching" range */ 116 #define LINKTYPE_NULL DLT_NULL 117 #define LINKTYPE_ETHERNET DLT_EN10MB /* also for 100Mb and up */ 118 #define LINKTYPE_EXP_ETHERNET DLT_EN3MB /* 3Mb experimental Ethernet */ 119 #define LINKTYPE_AX25 DLT_AX25 120 #define LINKTYPE_PRONET DLT_PRONET 121 #define LINKTYPE_CHAOS DLT_CHAOS 122 #define LINKTYPE_IEEE802_5 DLT_IEEE802 /* DLT_IEEE802 is used for 802.5 Token Ring */ 123 #define LINKTYPE_ARCNET_BSD DLT_ARCNET /* BSD-style headers */ 124 #define LINKTYPE_SLIP DLT_SLIP 125 #define LINKTYPE_PPP DLT_PPP 126 #define LINKTYPE_FDDI DLT_FDDI 127 128 #define LINKTYPE_LOW_MATCHING_MAX LINKTYPE_FDDI /* highest value in this "matching" range */ 129 130 /* 131 * LINKTYPE_PPP is for use when there might, or might not, be an RFC 1662 132 * PPP in HDLC-like framing header (with 0xff 0x03 before the PPP protocol 133 * field) at the beginning of the packet. 134 * 135 * This is for use when there is always such a header; the address field 136 * might be 0xff, for regular PPP, or it might be an address field for Cisco 137 * point-to-point with HDLC framing as per section 4.3.1 of RFC 1547 ("Cisco 138 * HDLC"). This is, for example, what you get with NetBSD's DLT_PPP_SERIAL. 139 * 140 * We give it the same value as NetBSD's DLT_PPP_SERIAL, in the hopes that 141 * nobody else will choose a DLT_ value of 50, and so that DLT_PPP_SERIAL 142 * captures will be written out with a link type that NetBSD's tcpdump 143 * can read. 144 */ 145 #define LINKTYPE_PPP_HDLC 50 /* PPP in HDLC-like framing */ 146 147 #define LINKTYPE_PPP_ETHER 51 /* NetBSD PPP-over-Ethernet */ 148 149 #define LINKTYPE_SYMANTEC_FIREWALL 99 /* Symantec Enterprise Firewall */ 150 151 /* 152 * These correspond to DLT_s that have different values on different 153 * platforms; we map between these values in capture files and 154 * the DLT_ values as returned by pcap_datalink() and passed to 155 * pcap_open_dead(). 156 */ 157 #define LINKTYPE_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */ 158 #define LINKTYPE_RAW 101 /* raw IP */ 159 #define LINKTYPE_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */ 160 #define LINKTYPE_PPP_BSDOS 103 /* BSD/OS PPP BPF header */ 161 162 /* 163 * Values starting with 104 are used for newly-assigned link-layer 164 * header type values; for those link-layer header types, the DLT_ 165 * value returned by pcap_datalink() and passed to pcap_open_dead(), 166 * and the LINKTYPE_ value that appears in capture files, are the 167 * same. 168 * 169 * LINKTYPE_HIGH_MATCHING_MIN is the lowest such value; 170 * LINKTYPE_HIGH_MATCHING_MAX is the highest such value. 171 */ 172 #define LINKTYPE_HIGH_MATCHING_MIN 104 /* lowest value in the "matching" range */ 173 174 #define LINKTYPE_C_HDLC 104 /* Cisco HDLC */ 175 #define LINKTYPE_IEEE802_11 105 /* IEEE 802.11 (wireless) */ 176 #define LINKTYPE_ATM_CLIP 106 /* Linux Classical IP over ATM */ 177 #define LINKTYPE_FRELAY 107 /* Frame Relay */ 178 #define LINKTYPE_LOOP 108 /* OpenBSD loopback */ 179 #define LINKTYPE_ENC 109 /* OpenBSD IPSEC enc */ 180 181 /* 182 * These two types are reserved for future use. 183 */ 184 #define LINKTYPE_LANE8023 110 /* ATM LANE + 802.3 */ 185 #define LINKTYPE_HIPPI 111 /* NetBSD HIPPI */ 186 187 /* 188 * Used for NetBSD DLT_HDLC; from looking at the one driver in NetBSD 189 * that uses it, it's Cisco HDLC, so it's the same as DLT_C_HDLC/ 190 * LINKTYPE_C_HDLC, but we define a separate value to avoid some 191 * compatibility issues with programs on NetBSD. 192 * 193 * All code should treat LINKTYPE_NETBSD_HDLC and LINKTYPE_C_HDLC the same. 194 */ 195 #define LINKTYPE_NETBSD_HDLC 112 /* NetBSD HDLC framing */ 196 197 #define LINKTYPE_LINUX_SLL 113 /* Linux cooked socket capture */ 198 #define LINKTYPE_LTALK 114 /* Apple LocalTalk hardware */ 199 #define LINKTYPE_ECONET 115 /* Acorn Econet */ 200 201 /* 202 * Reserved for use with OpenBSD ipfilter. 203 */ 204 #define LINKTYPE_IPFILTER 116 205 206 #define LINKTYPE_PFLOG 117 /* OpenBSD DLT_PFLOG */ 207 #define LINKTYPE_CISCO_IOS 118 /* For Cisco-internal use */ 208 #define LINKTYPE_IEEE802_11_PRISM 119 /* 802.11 plus Prism II monitor mode radio metadata header */ 209 #define LINKTYPE_IEEE802_11_AIRONET 120 /* 802.11 plus FreeBSD Aironet driver radio metadata header */ 210 211 /* 212 * Reserved for Siemens HiPath HDLC. 213 */ 214 #define LINKTYPE_HHDLC 121 215 216 #define LINKTYPE_IP_OVER_FC 122 /* RFC 2625 IP-over-Fibre Channel */ 217 #define LINKTYPE_SUNATM 123 /* Solaris+SunATM */ 218 219 /* 220 * Reserved as per request from Kent Dahlgren <kent (at) praesum.com> 221 * for private use. 222 */ 223 #define LINKTYPE_RIO 124 /* RapidIO */ 224 #define LINKTYPE_PCI_EXP 125 /* PCI Express */ 225 #define LINKTYPE_AURORA 126 /* Xilinx Aurora link layer */ 226 227 #define LINKTYPE_IEEE802_11_RADIOTAP 127 /* 802.11 plus radiotap radio metadata header */ 228 229 /* 230 * Reserved for the TZSP encapsulation, as per request from 231 * Chris Waters <chris.waters (at) networkchemistry.com> 232 * TZSP is a generic encapsulation for any other link type, 233 * which includes a means to include meta-information 234 * with the packet, e.g. signal strength and channel 235 * for 802.11 packets. 236 */ 237 #define LINKTYPE_TZSP 128 /* Tazmen Sniffer Protocol */ 238 239 #define LINKTYPE_ARCNET_LINUX 129 /* Linux-style headers */ 240 241 /* 242 * Juniper-private data link types, as per request from 243 * Hannes Gredler <hannes (at) juniper.net>. The corresponding 244 * DLT_s are used for passing on chassis-internal 245 * metainformation such as QOS profiles, etc.. 246 */ 247 #define LINKTYPE_JUNIPER_MLPPP 130 248 #define LINKTYPE_JUNIPER_MLFR 131 249 #define LINKTYPE_JUNIPER_ES 132 250 #define LINKTYPE_JUNIPER_GGSN 133 251 #define LINKTYPE_JUNIPER_MFR 134 252 #define LINKTYPE_JUNIPER_ATM2 135 253 #define LINKTYPE_JUNIPER_SERVICES 136 254 #define LINKTYPE_JUNIPER_ATM1 137 255 256 #define LINKTYPE_APPLE_IP_OVER_IEEE1394 138 /* Apple IP-over-IEEE 1394 cooked header */ 257 258 #define LINKTYPE_MTP2_WITH_PHDR 139 259 #define LINKTYPE_MTP2 140 260 #define LINKTYPE_MTP3 141 261 #define LINKTYPE_SCCP 142 262 263 #define LINKTYPE_DOCSIS 143 /* DOCSIS MAC frames */ 264 265 #define LINKTYPE_LINUX_IRDA 144 /* Linux-IrDA */ 266 267 /* 268 * Reserved for IBM SP switch and IBM Next Federation switch. 269 */ 270 #define LINKTYPE_IBM_SP 145 271 #define LINKTYPE_IBM_SN 146 272 273 /* 274 * Reserved for private use. If you have some link-layer header type 275 * that you want to use within your organization, with the capture files 276 * using that link-layer header type not ever be sent outside your 277 * organization, you can use these values. 278 * 279 * No libpcap release will use these for any purpose, nor will any 280 * tcpdump release use them, either. 281 * 282 * Do *NOT* use these in capture files that you expect anybody not using 283 * your private versions of capture-file-reading tools to read; in 284 * particular, do *NOT* use them in products, otherwise you may find that 285 * people won't be able to use tcpdump, or snort, or Ethereal, or... to 286 * read capture files from your firewall/intrusion detection/traffic 287 * monitoring/etc. appliance, or whatever product uses that LINKTYPE_ value, 288 * and you may also find that the developers of those applications will 289 * not accept patches to let them read those files. 290 * 291 * Also, do not use them if somebody might send you a capture using them 292 * for *their* private type and tools using them for *your* private type 293 * would have to read them. 294 * 295 * Instead, in those cases, ask "tcpdump-workers (at) lists.tcpdump.org" for a 296 * new DLT_ and LINKTYPE_ value, as per the comment in pcap/bpf.h, and use 297 * the type you're given. 298 */ 299 #define LINKTYPE_USER0 147 300 #define LINKTYPE_USER1 148 301 #define LINKTYPE_USER2 149 302 #define LINKTYPE_USER3 150 303 #define LINKTYPE_USER4 151 304 #define LINKTYPE_USER5 152 305 #define LINKTYPE_USER6 153 306 #define LINKTYPE_USER7 154 307 #define LINKTYPE_USER8 155 308 #define LINKTYPE_USER9 156 309 #define LINKTYPE_USER10 157 310 #define LINKTYPE_USER11 158 311 #define LINKTYPE_USER12 159 312 #define LINKTYPE_USER13 160 313 #define LINKTYPE_USER14 161 314 #define LINKTYPE_USER15 162 315 316 /* 317 * For future use with 802.11 captures - defined by AbsoluteValue 318 * Systems to store a number of bits of link-layer information 319 * including radio information: 320 * 321 * http://www.shaftnet.org/~pizza/software/capturefrm.txt 322 */ 323 #define LINKTYPE_IEEE802_11_AVS 163 /* 802.11 plus AVS radio metadata header */ 324 325 /* 326 * Juniper-private data link type, as per request from 327 * Hannes Gredler <hannes (at) juniper.net>. The corresponding 328 * DLT_s are used for passing on chassis-internal 329 * metainformation such as QOS profiles, etc.. 330 */ 331 #define LINKTYPE_JUNIPER_MONITOR 164 332 333 /* 334 * BACnet MS/TP frames. 335 */ 336 #define LINKTYPE_BACNET_MS_TP 165 337 338 /* 339 * Another PPP variant as per request from Karsten Keil <kkeil (at) suse.de>. 340 * 341 * This is used in some OSes to allow a kernel socket filter to distinguish 342 * between incoming and outgoing packets, on a socket intended to 343 * supply pppd with outgoing packets so it can do dial-on-demand and 344 * hangup-on-lack-of-demand; incoming packets are filtered out so they 345 * don't cause pppd to hold the connection up (you don't want random 346 * input packets such as port scans, packets from old lost connections, 347 * etc. to force the connection to stay up). 348 * 349 * The first byte of the PPP header (0xff03) is modified to accommodate 350 * the direction - 0x00 = IN, 0x01 = OUT. 351 */ 352 #define LINKTYPE_PPP_PPPD 166 353 354 /* 355 * Juniper-private data link type, as per request from 356 * Hannes Gredler <hannes (at) juniper.net>. The DLT_s are used 357 * for passing on chassis-internal metainformation such as 358 * QOS profiles, cookies, etc.. 359 */ 360 #define LINKTYPE_JUNIPER_PPPOE 167 361 #define LINKTYPE_JUNIPER_PPPOE_ATM 168 362 363 #define LINKTYPE_GPRS_LLC 169 /* GPRS LLC */ 364 #define LINKTYPE_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */ 365 #define LINKTYPE_GPF_F 171 /* GPF-F (ITU-T G.7041/Y.1303) */ 366 367 /* 368 * Requested by Oolan Zimmer <oz (at) gcom.com> for use in Gcom's T1/E1 line 369 * monitoring equipment. 370 */ 371 #define LINKTYPE_GCOM_T1E1 172 372 #define LINKTYPE_GCOM_SERIAL 173 373 374 /* 375 * Juniper-private data link type, as per request from 376 * Hannes Gredler <hannes (at) juniper.net>. The DLT_ is used 377 * for internal communication to Physical Interface Cards (PIC) 378 */ 379 #define LINKTYPE_JUNIPER_PIC_PEER 174 380 381 /* 382 * Link types requested by Gregor Maier <gregor (at) endace.com> of Endace 383 * Measurement Systems. They add an ERF header (see 384 * https://www.endace.com/support/EndaceRecordFormat.pdf) in front of 385 * the link-layer header. 386 */ 387 #define LINKTYPE_ERF_ETH 175 /* Ethernet */ 388 #define LINKTYPE_ERF_POS 176 /* Packet-over-SONET */ 389 390 /* 391 * Requested by Daniele Orlandi <daniele (at) orlandi.com> for raw LAPD 392 * for vISDN (http://www.orlandi.com/visdn/). Its link-layer header 393 * includes additional information before the LAPD header, so it's 394 * not necessarily a generic LAPD header. 395 */ 396 #define LINKTYPE_LINUX_LAPD 177 397 398 /* 399 * Juniper-private data link type, as per request from 400 * Hannes Gredler <hannes (at) juniper.net>. 401 * The Link Types are used for prepending meta-information 402 * like interface index, interface name 403 * before standard Ethernet, PPP, Frelay & C-HDLC Frames 404 */ 405 #define LINKTYPE_JUNIPER_ETHER 178 406 #define LINKTYPE_JUNIPER_PPP 179 407 #define LINKTYPE_JUNIPER_FRELAY 180 408 #define LINKTYPE_JUNIPER_CHDLC 181 409 410 /* 411 * Multi Link Frame Relay (FRF.16) 412 */ 413 #define LINKTYPE_MFR 182 414 415 /* 416 * Juniper-private data link type, as per request from 417 * Hannes Gredler <hannes (at) juniper.net>. 418 * The DLT_ is used for internal communication with a 419 * voice Adapter Card (PIC) 420 */ 421 #define LINKTYPE_JUNIPER_VP 183 422 423 /* 424 * Arinc 429 frames. 425 * DLT_ requested by Gianluca Varenni <gianluca.varenni (at) cacetech.com>. 426 * Every frame contains a 32bit A429 label. 427 * More documentation on Arinc 429 can be found at 428 * https://web.archive.org/web/20040616233302/https://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf 429 */ 430 #define LINKTYPE_A429 184 431 432 /* 433 * Arinc 653 Interpartition Communication messages. 434 * DLT_ requested by Gianluca Varenni <gianluca.varenni (at) cacetech.com>. 435 * Please refer to the A653-1 standard for more information. 436 */ 437 #define LINKTYPE_A653_ICM 185 438 439 /* 440 * This used to be "USB packets, beginning with a USB setup header; 441 * requested by Paolo Abeni <paolo.abeni (at) email.it>." 442 * 443 * However, that header didn't work all that well - it left out some 444 * useful information - and was abandoned in favor of the DLT_USB_LINUX 445 * header. 446 * 447 * This is now used by FreeBSD for its BPF taps for USB; that has its 448 * own headers. So it is written, so it is done. 449 */ 450 #define LINKTYPE_USB_FREEBSD 186 451 452 /* 453 * Bluetooth HCI UART transport layer (part H:4); requested by 454 * Paolo Abeni. 455 */ 456 #define LINKTYPE_BLUETOOTH_HCI_H4 187 457 458 /* 459 * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz 460 * <cruz_petagay (at) bah.com>. 461 */ 462 #define LINKTYPE_IEEE802_16_MAC_CPS 188 463 464 /* 465 * USB packets, beginning with a Linux USB header; requested by 466 * Paolo Abeni <paolo.abeni (at) email.it>. 467 */ 468 #define LINKTYPE_USB_LINUX 189 469 470 /* 471 * Controller Area Network (CAN) v. 2.0B packets. 472 * DLT_ requested by Gianluca Varenni <gianluca.varenni (at) cacetech.com>. 473 * Used to dump CAN packets coming from a CAN Vector board. 474 * More documentation on the CAN v2.0B frames can be found at 475 * http://www.can-cia.org/downloads/?269 476 */ 477 #define LINKTYPE_CAN20B 190 478 479 /* 480 * IEEE 802.15.4, with address fields padded, as is done by Linux 481 * drivers; requested by Juergen Schimmer. 482 */ 483 #define LINKTYPE_IEEE802_15_4_LINUX 191 484 485 /* 486 * Per Packet Information encapsulated packets. 487 * LINKTYPE_ requested by Gianluca Varenni <gianluca.varenni (at) cacetech.com>. 488 */ 489 #define LINKTYPE_PPI 192 490 491 /* 492 * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header; 493 * requested by Charles Clancy. 494 */ 495 #define LINKTYPE_IEEE802_16_MAC_CPS_RADIO 193 496 497 /* 498 * Juniper-private data link type, as per request from 499 * Hannes Gredler <hannes (at) juniper.net>. 500 * The DLT_ is used for internal communication with a 501 * integrated service module (ISM). 502 */ 503 #define LINKTYPE_JUNIPER_ISM 194 504 505 /* 506 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 507 * nothing), and with the FCS at the end of the frame; requested by 508 * Mikko Saarnivala <mikko.saarnivala (at) sensinode.com>. 509 * 510 * This should only be used if the FCS is present at the end of the 511 * frame; if the frame has no FCS, DLT_IEEE802_15_4_NOFCS should be 512 * used. 513 */ 514 #define LINKTYPE_IEEE802_15_4_WITHFCS 195 515 516 /* 517 * Various link-layer types, with a pseudo-header, for SITA 518 * (https://www.sita.aero/); requested by Fulko Hew (fulko.hew (at) gmail.com). 519 */ 520 #define LINKTYPE_SITA 196 521 522 /* 523 * Various link-layer types, with a pseudo-header, for Endace DAG cards; 524 * encapsulates Endace ERF records. Requested by Stephen Donnelly 525 * <stephen (at) endace.com>. 526 */ 527 #define LINKTYPE_ERF 197 528 529 /* 530 * Special header prepended to Ethernet packets when capturing from a 531 * u10 Networks board. Requested by Phil Mulholland 532 * <phil (at) u10networks.com>. 533 */ 534 #define LINKTYPE_RAIF1 198 535 536 /* 537 * IPMB packet for IPMI, beginning with a 2-byte header, followed by 538 * the I2C slave address, followed by the netFn and LUN, etc.. 539 * Requested by Chanthy Toeung <chanthy.toeung (at) ca.kontron.com>. 540 * 541 * XXX - its DLT_ value used to be called DLT_IPMB, back when we got the 542 * impression from the email thread requesting it that the packet 543 * had no extra 2-byte header. We've renamed it; if anybody used 544 * DLT_IPMB and assumed no 2-byte header, this will cause the compile 545 * to fail, at which point we'll have to figure out what to do about 546 * the two header types using the same DLT_/LINKTYPE_ value. If that 547 * doesn't happen, we'll assume nobody used it and that the redefinition 548 * is safe. 549 */ 550 #define LINKTYPE_IPMB_KONTRON 199 551 552 /* 553 * Juniper-private data link type, as per request from 554 * Hannes Gredler <hannes (at) juniper.net>. 555 * The DLT_ is used for capturing data on a secure tunnel interface. 556 */ 557 #define LINKTYPE_JUNIPER_ST 200 558 559 /* 560 * Bluetooth HCI UART transport layer (part H:4), with pseudo-header 561 * that includes direction information; requested by Paolo Abeni. 562 */ 563 #define LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR 201 564 565 /* 566 * AX.25 packet with a 1-byte KISS header; see 567 * 568 * http://www.ax25.net/kiss.htm 569 * 570 * as per Richard Stearn <richard (at) rns-stearn.demon.co.uk>. 571 */ 572 #define LINKTYPE_AX25_KISS 202 573 574 /* 575 * LAPD packets from an ISDN channel, starting with the address field, 576 * with no pseudo-header. 577 * Requested by Varuna De Silva <varunax (at) gmail.com>. 578 */ 579 #define LINKTYPE_LAPD 203 580 581 /* 582 * PPP, with a one-byte direction pseudo-header prepended - zero means 583 * "received by this host", non-zero (any non-zero value) means "sent by 584 * this host" - as per Will Barker <w.barker (at) zen.co.uk>. 585 */ 586 #define LINKTYPE_PPP_WITH_DIR 204 /* Don't confuse with LINKTYPE_PPP_PPPD */ 587 588 /* 589 * Cisco HDLC, with a one-byte direction pseudo-header prepended - zero 590 * means "received by this host", non-zero (any non-zero value) means 591 * "sent by this host" - as per Will Barker <w.barker (at) zen.co.uk>. 592 */ 593 #define LINKTYPE_C_HDLC_WITH_DIR 205 /* Cisco HDLC */ 594 595 /* 596 * Frame Relay, with a one-byte direction pseudo-header prepended - zero 597 * means "received by this host" (DCE -> DTE), non-zero (any non-zero 598 * value) means "sent by this host" (DTE -> DCE) - as per Will Barker 599 * <w.barker (at) zen.co.uk>. 600 */ 601 #define LINKTYPE_FRELAY_WITH_DIR 206 /* Frame Relay */ 602 603 /* 604 * LAPB, with a one-byte direction pseudo-header prepended - zero means 605 * "received by this host" (DCE -> DTE), non-zero (any non-zero value) 606 * means "sent by this host" (DTE -> DCE)- as per Will Barker 607 * <w.barker (at) zen.co.uk>. 608 */ 609 #define LINKTYPE_LAPB_WITH_DIR 207 /* LAPB */ 610 611 /* 612 * 208 is reserved for an as-yet-unspecified proprietary link-layer 613 * type, as requested by Will Barker. 614 */ 615 616 /* 617 * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman 618 * <avn (at) pigeonpoint.com>. 619 */ 620 #define LINKTYPE_IPMB_LINUX 209 621 622 /* 623 * FlexRay automotive bus - http://www.flexray.com/ - as requested 624 * by Hannes Kaelber <hannes.kaelber (at) x2e.de>. 625 */ 626 #define LINKTYPE_FLEXRAY 210 627 628 /* 629 * Media Oriented Systems Transport (MOST) bus for multimedia 630 * transport - https://www.mostcooperation.com/ - as requested 631 * by Hannes Kaelber <hannes.kaelber (at) x2e.de>. 632 */ 633 #define LINKTYPE_MOST 211 634 635 /* 636 * Local Interconnect Network (LIN) bus for vehicle networks - 637 * http://www.lin-subbus.org/ - as requested by Hannes Kaelber 638 * <hannes.kaelber (at) x2e.de>. 639 */ 640 #define LINKTYPE_LIN 212 641 642 /* 643 * X2E-private data link type used for serial line capture, 644 * as requested by Hannes Kaelber <hannes.kaelber (at) x2e.de>. 645 */ 646 #define LINKTYPE_X2E_SERIAL 213 647 648 /* 649 * X2E-private data link type used for the Xoraya data logger 650 * family, as requested by Hannes Kaelber <hannes.kaelber (at) x2e.de>. 651 */ 652 #define LINKTYPE_X2E_XORAYA 214 653 654 /* 655 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 656 * nothing), but with the PHY-level data for non-ASK PHYs (4 octets 657 * of 0 as preamble, one octet of SFD, one octet of frame length+ 658 * reserved bit, and then the MAC-layer data, starting with the 659 * frame control field). 660 * 661 * Requested by Max Filippov <jcmvbkbc (at) gmail.com>. 662 */ 663 #define LINKTYPE_IEEE802_15_4_NONASK_PHY 215 664 665 /* 666 * David Gibson <david (at) gibson.dropbear.id.au> requested this for 667 * captures from the Linux kernel /dev/input/eventN devices. This 668 * is used to communicate keystrokes and mouse movements from the 669 * Linux kernel to display systems, such as Xorg. 670 */ 671 #define LINKTYPE_LINUX_EVDEV 216 672 673 /* 674 * GSM Um and Abis interfaces, preceded by a "gsmtap" header. 675 * 676 * Requested by Harald Welte <laforge (at) gnumonks.org>. 677 */ 678 #define LINKTYPE_GSMTAP_UM 217 679 #define LINKTYPE_GSMTAP_ABIS 218 680 681 /* 682 * MPLS, with an MPLS label as the link-layer header. 683 * Requested by Michele Marchetto <michele (at) openbsd.org> on behalf 684 * of OpenBSD. 685 */ 686 #define LINKTYPE_MPLS 219 687 688 /* 689 * USB packets, beginning with a Linux USB header, with the USB header 690 * padded to 64 bytes; required for memory-mapped access. 691 */ 692 #define LINKTYPE_USB_LINUX_MMAPPED 220 693 694 /* 695 * DECT packets, with a pseudo-header; requested by 696 * Matthias Wenzel <tcpdump (at) mazzoo.de>. 697 */ 698 #define LINKTYPE_DECT 221 699 700 /* 701 * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1 (at) nasa.gov> 702 * Date: Mon, 11 May 2009 11:18:30 -0500 703 * 704 * DLT_AOS. We need it for AOS Space Data Link Protocol. 705 * I have already written dissectors for but need an OK from 706 * legal before I can submit a patch. 707 * 708 */ 709 #define LINKTYPE_AOS 222 710 711 /* 712 * WirelessHART (Highway Addressable Remote Transducer) 713 * From the HART Communication Foundation 714 * IEC/PAS 62591 715 * 716 * Requested by Sam Roberts <vieuxtech (at) gmail.com>. 717 */ 718 #define LINKTYPE_WIHART 223 719 720 /* 721 * Fibre Channel FC-2 frames, beginning with a Frame_Header. 722 * Requested by Kahou Lei <kahou82 (at) gmail.com>. 723 */ 724 #define LINKTYPE_FC_2 224 725 726 /* 727 * Fibre Channel FC-2 frames, beginning with an encoding of the 728 * SOF, and ending with an encoding of the EOF. 729 * 730 * The encodings represent the frame delimiters as 4-byte sequences 731 * representing the corresponding ordered sets, with K28.5 732 * represented as 0xBC, and the D symbols as the corresponding 733 * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2, 734 * is represented as 0xBC 0xB5 0x55 0x55. 735 * 736 * Requested by Kahou Lei <kahou82 (at) gmail.com>. 737 */ 738 #define LINKTYPE_FC_2_WITH_FRAME_DELIMS 225 739 740 /* 741 * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed (at) Sun.COM>. 742 * 743 * The pseudo-header starts with a one-byte version number; for version 2, 744 * the pseudo-header is: 745 * 746 * struct dl_ipnetinfo { 747 * uint8_t dli_version; 748 * uint8_t dli_family; 749 * uint16_t dli_htype; 750 * uint32_t dli_pktlen; 751 * uint32_t dli_ifindex; 752 * uint32_t dli_grifindex; 753 * uint32_t dli_zsrc; 754 * uint32_t dli_zdst; 755 * }; 756 * 757 * dli_version is 2 for the current version of the pseudo-header. 758 * 759 * dli_family is a Solaris address family value, so it's 2 for IPv4 760 * and 26 for IPv6. 761 * 762 * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing 763 * packets, and 2 for packets arriving from another zone on the same 764 * machine. 765 * 766 * dli_pktlen is the length of the packet data following the pseudo-header 767 * (so the captured length minus dli_pktlen is the length of the 768 * pseudo-header, assuming the entire pseudo-header was captured). 769 * 770 * dli_ifindex is the interface index of the interface on which the 771 * packet arrived. 772 * 773 * dli_grifindex is the group interface index number (for IPMP interfaces). 774 * 775 * dli_zsrc is the zone identifier for the source of the packet. 776 * 777 * dli_zdst is the zone identifier for the destination of the packet. 778 * 779 * A zone number of 0 is the global zone; a zone number of 0xffffffff 780 * means that the packet arrived from another host on the network, not 781 * from another zone on the same machine. 782 * 783 * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates 784 * which of those it is. 785 */ 786 #define LINKTYPE_IPNET 226 787 788 /* 789 * CAN (Controller Area Network) frames, with a pseudo-header as supplied 790 * by Linux SocketCAN, and with multi-byte numerical fields in that header 791 * in big-endian byte order. 792 * 793 * See Documentation/networking/can.txt in the Linux source. 794 * 795 * Requested by Felix Obenhuber <felix (at) obenhuber.de>. 796 */ 797 #define LINKTYPE_CAN_SOCKETCAN 227 798 799 /* 800 * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies 801 * whether it's v4 or v6. Requested by Darren Reed <Darren.Reed (at) Sun.COM>. 802 */ 803 #define LINKTYPE_IPV4 228 804 #define LINKTYPE_IPV6 229 805 806 /* 807 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 808 * nothing), and with no FCS at the end of the frame; requested by 809 * Jon Smirl <jonsmirl (at) gmail.com>. 810 */ 811 #define LINKTYPE_IEEE802_15_4_NOFCS 230 812 813 /* 814 * Raw D-Bus: 815 * 816 * https://www.freedesktop.org/wiki/Software/dbus 817 * 818 * messages: 819 * 820 * https://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages 821 * 822 * starting with the endianness flag, followed by the message type, etc., 823 * but without the authentication handshake before the message sequence: 824 * 825 * https://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol 826 * 827 * Requested by Martin Vidner <martin (at) vidner.net>. 828 */ 829 #define LINKTYPE_DBUS 231 830 831 /* 832 * Juniper-private data link type, as per request from 833 * Hannes Gredler <hannes (at) juniper.net>. 834 */ 835 #define LINKTYPE_JUNIPER_VS 232 836 #define LINKTYPE_JUNIPER_SRX_E2E 233 837 #define LINKTYPE_JUNIPER_FIBRECHANNEL 234 838 839 /* 840 * DVB-CI (DVB Common Interface for communication between a PC Card 841 * module and a DVB receiver). See 842 * 843 * https://www.kaiser.cx/pcap-dvbci.html 844 * 845 * for the specification. 846 * 847 * Requested by Martin Kaiser <martin (at) kaiser.cx>. 848 */ 849 #define LINKTYPE_DVB_CI 235 850 851 /* 852 * Variant of 3GPP TS 27.010 multiplexing protocol. Requested 853 * by Hans-Christoph Schemmel <hans-christoph.schemmel (at) cinterion.com>. 854 */ 855 #define LINKTYPE_MUX27010 236 856 857 /* 858 * STANAG 5066 D_PDUs. Requested by M. Baris Demiray 859 * <barisdemiray (at) gmail.com>. 860 */ 861 #define LINKTYPE_STANAG_5066_D_PDU 237 862 863 /* 864 * Juniper-private data link type, as per request from 865 * Hannes Gredler <hannes (at) juniper.net>. 866 */ 867 #define LINKTYPE_JUNIPER_ATM_CEMIC 238 868 869 /* 870 * NetFilter LOG messages 871 * (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets) 872 * 873 * Requested by Jakub Zawadzki <darkjames-ws (at) darkjames.pl> 874 */ 875 #define LINKTYPE_NFLOG 239 876 877 /* 878 * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type 879 * for Ethernet packets with a 4-byte pseudo-header and always 880 * with the payload including the FCS, as supplied by their 881 * netANALYZER hardware and software. 882 * 883 * Requested by Holger P. Frommer <HPfrommer (at) hilscher.com> 884 */ 885 #define LINKTYPE_NETANALYZER 240 886 887 /* 888 * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type 889 * for Ethernet packets with a 4-byte pseudo-header and FCS and 890 * 1 byte of SFD, as supplied by their netANALYZER hardware and 891 * software. 892 * 893 * Requested by Holger P. Frommer <HPfrommer (at) hilscher.com> 894 */ 895 #define LINKTYPE_NETANALYZER_TRANSPARENT 241 896 897 /* 898 * IP-over-InfiniBand, as specified by RFC 4391. 899 * 900 * Requested by Petr Sumbera <petr.sumbera (at) oracle.com>. 901 */ 902 #define LINKTYPE_IPOIB 242 903 904 /* 905 * MPEG-2 transport stream (ISO 13818-1/ITU-T H.222.0). 906 * 907 * Requested by Guy Martin <gmsoft (at) tuxicoman.be>. 908 */ 909 #define LINKTYPE_MPEG_2_TS 243 910 911 /* 912 * ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as 913 * used by their ng40 protocol tester. 914 * 915 * Requested by Jens Grimmer <jens.grimmer (at) ng4t.com>. 916 */ 917 #define LINKTYPE_NG40 244 918 919 /* 920 * Pseudo-header giving adapter number and flags, followed by an NFC 921 * (Near-Field Communications) Logical Link Control Protocol (LLCP) PDU, 922 * as specified by NFC Forum Logical Link Control Protocol Technical 923 * Specification LLCP 1.1. 924 * 925 * Requested by Mike Wakerly <mikey (at) google.com>. 926 */ 927 #define LINKTYPE_NFC_LLCP 245 928 929 /* 930 * pfsync output; DLT_PFSYNC is 18, which collides with DLT_CIP in 931 * SuSE 6.3, on OpenBSD, NetBSD, DragonFly BSD, and macOS, and 932 * is 121, which collides with DLT_HHDLC, in FreeBSD. We pick a 933 * shiny new link-layer header type value that doesn't collide with 934 * anything, in the hopes that future pfsync savefiles, if any, 935 * won't require special hacks to distinguish from other savefiles. 936 */ 937 #define LINKTYPE_PFSYNC 246 938 939 /* 940 * Raw InfiniBand packets, starting with the Local Routing Header. 941 * 942 * Requested by Oren Kladnitsky <orenk (at) mellanox.com>. 943 */ 944 #define LINKTYPE_INFINIBAND 247 945 946 /* 947 * SCTP, with no lower-level protocols (i.e., no IPv4 or IPv6). 948 * 949 * Requested by Michael Tuexen <Michael.Tuexen (at) lurchi.franken.de>. 950 */ 951 #define LINKTYPE_SCTP 248 952 953 /* 954 * USB packets, beginning with a USBPcap header. 955 * 956 * Requested by Tomasz Mon <desowin (at) gmail.com> 957 */ 958 #define LINKTYPE_USBPCAP 249 959 960 /* 961 * Schweitzer Engineering Laboratories "RTAC" product serial-line 962 * packets. 963 * 964 * Requested by Chris Bontje <chris_bontje (at) selinc.com>. 965 */ 966 #define LINKTYPE_RTAC_SERIAL 250 967 968 /* 969 * Bluetooth Low Energy air interface link-layer packets. 970 * 971 * Requested by Mike Kershaw <dragorn (at) kismetwireless.net>. 972 */ 973 #define LINKTYPE_BLUETOOTH_LE_LL 251 974 975 /* 976 * Link-layer header type for upper-protocol layer PDU saves from wireshark. 977 * 978 * the actual contents are determined by two TAGs, one or more of 979 * which is stored with each packet: 980 * 981 * EXP_PDU_TAG_DISSECTOR_NAME the name of the Wireshark dissector 982 * that can make sense of the data stored. 983 * 984 * EXP_PDU_TAG_HEUR_DISSECTOR_NAME the name of the Wireshark heuristic 985 * dissector that can make sense of the 986 * data stored. 987 */ 988 #define LINKTYPE_WIRESHARK_UPPER_PDU 252 989 990 /* 991 * Link-layer header type for the netlink protocol (nlmon devices). 992 */ 993 #define LINKTYPE_NETLINK 253 994 995 /* 996 * Bluetooth Linux Monitor headers for the BlueZ stack. 997 */ 998 #define LINKTYPE_BLUETOOTH_LINUX_MONITOR 254 999 1000 /* 1001 * Bluetooth Basic Rate/Enhanced Data Rate baseband packets, as 1002 * captured by Ubertooth. 1003 */ 1004 #define LINKTYPE_BLUETOOTH_BREDR_BB 255 1005 1006 /* 1007 * Bluetooth Low Energy link layer packets, as captured by Ubertooth. 1008 */ 1009 #define LINKTYPE_BLUETOOTH_LE_LL_WITH_PHDR 256 1010 1011 /* 1012 * PROFIBUS data link layer. 1013 */ 1014 #define LINKTYPE_PROFIBUS_DL 257 1015 1016 /* 1017 * Apple's DLT_PKTAP headers. 1018 * 1019 * Sadly, the folks at Apple either had no clue that the DLT_USERn values 1020 * are for internal use within an organization and partners only, and 1021 * didn't know that the right way to get a link-layer header type is to 1022 * ask tcpdump.org for one, or knew and didn't care, so they just 1023 * used DLT_USER2, which causes problems for everything except for 1024 * their version of tcpdump. 1025 * 1026 * So I'll just give them one; hopefully this will show up in a 1027 * libpcap release in time for them to get this into 10.10 Big Sur 1028 * or whatever Mavericks' successor is called. LINKTYPE_PKTAP 1029 * will be 258 *even on macOS*; that is *intentional*, so that 1030 * PKTAP files look the same on *all* OSes (different OSes can have 1031 * different numerical values for a given DLT_, but *MUST NOT* have 1032 * different values for what goes in a file, as files can be moved 1033 * between OSes!). 1034 */ 1035 #define LINKTYPE_PKTAP 258 1036 1037 /* 1038 * Ethernet packets preceded by a header giving the last 6 octets 1039 * of the preamble specified by 802.3-2012 Clause 65, section 1040 * 65.1.3.2 "Transmit". 1041 */ 1042 #define LINKTYPE_EPON 259 1043 1044 /* 1045 * IPMI trace packets, as specified by Table 3-20 "Trace Data Block Format" 1046 * in the PICMG HPM.2 specification. 1047 */ 1048 #define LINKTYPE_IPMI_HPM_2 260 1049 1050 /* 1051 * per Joshua Wright <jwright (at) hasborg.com>, formats for Zwave captures. 1052 */ 1053 #define LINKTYPE_ZWAVE_R1_R2 261 1054 #define LINKTYPE_ZWAVE_R3 262 1055 1056 /* 1057 * per Steve Karg <skarg (at) users.sourceforge.net>, formats for Wattstopper 1058 * Digital Lighting Management room bus serial protocol captures. 1059 */ 1060 #define LINKTYPE_WATTSTOPPER_DLM 263 1061 1062 /* 1063 * ISO 14443 contactless smart card messages. 1064 */ 1065 #define LINKTYPE_ISO_14443 264 1066 1067 /* 1068 * Radio data system (RDS) groups. IEC 62106. 1069 * Per Jonathan Brucker <jonathan.brucke (at) gmail.com>. 1070 */ 1071 #define LINKTYPE_RDS 265 1072 1073 /* 1074 * USB packets, beginning with a Darwin (macOS, etc.) header. 1075 */ 1076 #define LINKTYPE_USB_DARWIN 266 1077 1078 /* 1079 * OpenBSD DLT_OPENFLOW. 1080 */ 1081 #define LINKTYPE_OPENFLOW 267 1082 1083 /* 1084 * SDLC frames containing SNA PDUs. 1085 */ 1086 #define LINKTYPE_SDLC 268 1087 1088 /* 1089 * per "Selvig, Bjorn" <b.selvig (at) ti.com> used for 1090 * TI protocol sniffer. 1091 */ 1092 #define LINKTYPE_TI_LLN_SNIFFER 269 1093 1094 /* 1095 * per: Erik de Jong <erikdejong at gmail.com> for 1096 * https://github.com/eriknl/LoRaTap/releases/tag/v0.1 1097 */ 1098 #define LINKTYPE_LORATAP 270 1099 1100 /* 1101 * per: Stefanha at gmail.com for 1102 * https://lists.sandelman.ca/pipermail/tcpdump-workers/2017-May/000772.html 1103 * and: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/vsockmon.h 1104 * for: https://qemu-project.org/Features/VirtioVsock 1105 */ 1106 #define LINKTYPE_VSOCK 271 1107 1108 /* 1109 * Nordic Semiconductor Bluetooth LE sniffer. 1110 */ 1111 #define LINKTYPE_NORDIC_BLE 272 1112 1113 /* 1114 * Excentis DOCSIS 3.1 RF sniffer (XRA-31) 1115 * per: bruno.verstuyft at excentis.com 1116 * https://www.xra31.com/xra-header 1117 */ 1118 #define LINKTYPE_DOCSIS31_XRA31 273 1119 1120 /* 1121 * mPackets, as specified by IEEE 802.3br Figure 99-4, starting 1122 * with the preamble and always ending with a CRC field. 1123 */ 1124 #define LINKTYPE_ETHERNET_MPACKET 274 1125 1126 /* 1127 * DisplayPort AUX channel monitoring data as specified by VESA 1128 * DisplayPort(DP) Standard preceded by a pseudo-header. 1129 * per dirk.eibach at gdsys.cc 1130 */ 1131 #define LINKTYPE_DISPLAYPORT_AUX 275 1132 1133 /* 1134 * Linux cooked sockets v2. 1135 */ 1136 #define LINKTYPE_LINUX_SLL2 276 1137 1138 /* 1139 * Sercos Monitor, per Manuel Jacob <manuel.jacob at steinbeis-stg.de> 1140 */ 1141 #define LINKTYPE_SERCOS_MONITOR 277 1142 1143 /* 1144 * OpenVizsla http://openvizsla.org is open source USB analyzer hardware. 1145 * It consists of FPGA with attached USB phy and FTDI chip for streaming 1146 * the data to the host PC. 1147 * 1148 * Current OpenVizsla data encapsulation format is described here: 1149 * https://github.com/matwey/libopenvizsla/wiki/OpenVizsla-protocol-description 1150 * 1151 */ 1152 #define LINKTYPE_OPENVIZSLA 278 1153 1154 /* 1155 * The Elektrobit High Speed Capture and Replay (EBHSCR) protocol is produced 1156 * by a PCIe Card for interfacing high speed automotive interfaces. 1157 * 1158 * The specification for this frame format can be found at: 1159 * https://www.elektrobit.com/ebhscr 1160 * 1161 * for Guenter.Ebermann at elektrobit.com 1162 * 1163 */ 1164 #define LINKTYPE_EBHSCR 279 1165 1166 /* 1167 * The https://fd.io vpp graph dispatch tracer produces pcap trace files 1168 * in the format documented here: 1169 * https://fdio-vpp.readthedocs.io/en/latest/gettingstarted/developers/vnet.html#graph-dispatcher-pcap-tracing 1170 */ 1171 #define LINKTYPE_VPP_DISPATCH 280 1172 1173 /* 1174 * Broadcom Ethernet switches (ROBO switch) 4 bytes proprietary tagging format. 1175 */ 1176 #define LINKTYPE_DSA_TAG_BRCM 281 1177 #define LINKTYPE_DSA_TAG_BRCM_PREPEND 282 1178 1179 /* 1180 * IEEE 802.15.4 with pseudo-header and optional meta-data TLVs, PHY payload 1181 * exactly as it appears in the spec (no padding, no nothing), and FCS if 1182 * specified by FCS Type TLV; requested by James Ko <jck (at) exegin.com>. 1183 * Specification at https://github.com/jkcko/ieee802.15.4-tap 1184 */ 1185 #define LINKTYPE_IEEE802_15_4_TAP 283 1186 1187 /* 1188 * Marvell (Ethertype) Distributed Switch Architecture proprietary tagging format. 1189 */ 1190 #define LINKTYPE_DSA_TAG_DSA 284 1191 #define LINKTYPE_DSA_TAG_EDSA 285 1192 1193 /* 1194 * Payload of lawful intercept packets using the ELEE protocol; 1195 * https://socket.hr/draft-dfranusic-opsawg-elee-00.xml 1196 * https://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?url=https://socket.hr/draft-dfranusic-opsawg-elee-00.xml&modeAsFormat=html/ascii 1197 */ 1198 #define LINKTYPE_ELEE 286 1199 1200 /* 1201 * Serial frames transmitted between a host and a Z-Wave chip. 1202 */ 1203 #define LINKTYPE_Z_WAVE_SERIAL 287 1204 1205 /* 1206 * USB 2.0, 1.1, and 1.0 packets as transmitted over the cable. 1207 * Deprecated in favor of speed specific LINKTYPEs: LINKTYPE_USB_2_0_LOW_SPEED, 1208 * LINKTYPE_USB_2_0_FULL_SPEED and LINKTYPE_USB_2_0_HIGH_SPEED. 1209 */ 1210 #define LINKTYPE_USB_2_0 288 1211 1212 /* 1213 * ATSC Link-Layer Protocol (A/330) packets. 1214 */ 1215 #define LINKTYPE_ATSC_ALP 289 1216 1217 /* 1218 * Event Tracing for Windows messages. 1219 */ 1220 #define LINKTYPE_ETW 290 1221 1222 /* 1223 * Hilscher Gesellschaft fuer Systemautomation mbH 1224 * netANALYZER NG hardware and software. 1225 * 1226 * The specification for this footer can be found at: 1227 * https://kb.hilscher.com/x/brDJBw 1228 * 1229 * Requested by Jan Adam <jadam (at) hilscher.com> 1230 */ 1231 #define LINKTYPE_NETANALYZER_NG 291 1232 1233 /* 1234 * Serial NCP (Network Co-Processor) protocol for Zigbee stack ZBOSS 1235 * by DSR, https://dsr-iot.com/downloads 1236 */ 1237 #define LINKTYPE_ZBOSS_NCP 292 1238 1239 /* 1240 * USB 2.0, 1.1, and 1.0 packets as transmitted over the cable. 1241 */ 1242 #define LINKTYPE_USB_2_0_LOW_SPEED 293 1243 #define LINKTYPE_USB_2_0_FULL_SPEED 294 1244 #define LINKTYPE_USB_2_0_HIGH_SPEED 295 1245 1246 /* 1247 * Auerswald Logger Protocol 1248 * description is provided on 1249 * https://github.com/Auerswald-GmbH/auerlog/blob/master/auerlog.txt 1250 * requested by Auerswald Developer Team <developer(at)auerswald.de> 1251 */ 1252 #define LINKTYPE_AUERSWALD_LOG 296 1253 1254 /* 1255 * Z-Wave packets with a TAP meta-data header 1256 * https://gitlab.com/exegin/zwave-g9959-tap 1257 * requested on tcpdump-workers@ 1258 */ 1259 #define LINKTYPE_ZWAVE_TAP 297 1260 1261 /* 1262 * Silicon Labs debug channel protocol: 1263 */ 1264 #define LINKTYPE_SILABS_DEBUG_CHANNEL 298 1265 1266 /* 1267 * Ultra-wideband (UWB) controller interface protocol (UCI). 1268 */ 1269 #define LINKTYPE_FIRA_UCI 299 1270 1271 /* 1272 * MDB (Multi-Drop Bus) protocol between a vending machine controller and 1273 * peripherals inside the vending machine. See 1274 * 1275 * https://www.kaiser.cx/pcap-mdb.html 1276 * 1277 * for the specification. 1278 * 1279 * Requested by Martin Kaiser <martin (at) kaiser.cx>. 1280 */ 1281 #define LINKTYPE_MDB 300 1282 1283 /* 1284 * DECT-2020 New Radio (NR) - ETSI TS 103 636. 1285 * Requested by Stig Bjorlykke <stig (at) bjorlykke.org>. 1286 */ 1287 #define LINKTYPE_DECT_NR 301 1288 1289 /* 1290 * Request serialization protocol used by edk2 firmware to communicate between 1291 * normal mode and management mode ('MM' for short). 1292 * 1293 * The qemu uefi variable store implementation reuses the request serialization 1294 * protocol for firmware <-> qemu communication. 1295 */ 1296 #define LINKTYPE_EDK2_MM 302 1297 1298 // See DLT_DEBUG_ONLY 1299 #define LINKTYPE_DEBUG_ONLY 303 1300 1301 #define LINKTYPE_HIGH_MATCHING_MAX 303 /* highest value in the "matching" range */ 1302 1303 /* 1304 * The DLT_ and LINKTYPE_ values in the "matching" range should be the 1305 * same, so DLT_HIGH_MATCHING_MAX and LINKTYPE_HIGH_MATCHING_MAX should be the 1306 * same. 1307 */ 1308 #if LINKTYPE_HIGH_MATCHING_MAX != DLT_HIGH_MATCHING_MAX 1309 #error The LINKTYPE_ high matching range does not match the DLT_ matching range 1310 #endif 1311 1312 /* 1313 * Map a DLT_* code to the corresponding LINKTYPE_* code. 1314 * Used to generate link-layer types written to savefiles. 1315 */ 1316 int 1317 dlt_to_linktype(int dlt) 1318 { 1319 /* 1320 * All values in the low matching range were handed out before 1321 * assigning DLT_* codes became a free-for-all, so they're the 1322 * same on all platforms, and thus are given LINKTYPE_* codes 1323 * with the same numerical values as the corresponding DLT_* 1324 * code. 1325 */ 1326 if (dlt >= DLT_LOW_MATCHING_MIN && dlt <= DLT_LOW_MATCHING_MAX) 1327 return (dlt); 1328 1329 #if DLT_PFSYNC != LINKTYPE_PFSYNC 1330 /* 1331 * DLT_PFSYNC has a code on several platforms that's in the 1332 * non-matching range, a code on FreeBSD that's in the high 1333 * matching range and that's *not* equal to LINKTYPE_PFSYNC, 1334 * and has a code on the rmaining platforms that's equal 1335 * to LINKTYPE_PFSYNC, which is in the high matching range. 1336 * 1337 * Map it to LINKTYPE_PFSYNC if it's not equal to LINKTYPE_PFSYNC. 1338 */ 1339 if (dlt == DLT_PFSYNC) 1340 return (LINKTYPE_PFSYNC); 1341 #endif 1342 1343 /* 1344 * DLT_PKTAP is defined as DLT_USER2 - which is in the high 1345 * matching range - on Darwin because Apple used DLT_USER2 1346 * on systems that users ran, not just as an internal thing. 1347 * 1348 * We map it to LINKTYPE_PKTAP if it's not equal to LINKTYPE_PKTAP 1349 * so that DLT_PKTAP captures from Apple machines can be read by 1350 * software that either doesn't handle DLT_USER2 or that handles it 1351 * as something other than Apple PKTAP. 1352 */ 1353 #if DLT_PKTAP != LINKTYPE_PKTAP 1354 if (dlt == DLT_PKTAP) 1355 return (LINKTYPE_PKTAP); 1356 #endif 1357 1358 /* 1359 * For all other DLT_* codes in the high matching range, the DLT 1360 * code value is the same as the LINKTYPE_* code value. 1361 */ 1362 if (dlt >= DLT_HIGH_MATCHING_MIN && dlt <= DLT_HIGH_MATCHING_MAX) 1363 return (dlt); 1364 1365 /* 1366 * These DLT_* codes have different values on different 1367 * platforms, so we assigned them LINKTYPE_* codes just 1368 * below the lower bound of the high matching range; 1369 * those values should never be equal to any DLT_* 1370 * code, so that should avoid collisions. 1371 * 1372 * That way, for example, "raw IP" packets will have 1373 * LINKTYPE_RAW as the code in all savefiles for 1374 * which the code that writes them maps to that 1375 * value, regardless of the platform on which they 1376 * were written, so they should be readable on all 1377 * platforms without having to determine on which 1378 * platform they were written. 1379 * 1380 * We map the DLT_* codes on this platform, whatever 1381 * it might be, to the corresponding LINKTYPE_* codes. 1382 */ 1383 if (dlt == DLT_ATM_RFC1483) 1384 return (LINKTYPE_ATM_RFC1483); 1385 if (dlt == DLT_RAW) 1386 return (LINKTYPE_RAW); 1387 if (dlt == DLT_SLIP_BSDOS) 1388 return (LINKTYPE_SLIP_BSDOS); 1389 if (dlt == DLT_PPP_BSDOS) 1390 return (LINKTYPE_PPP_BSDOS); 1391 1392 /* 1393 * These DLT_* codes were originally defined on some platform, 1394 * and weren't defined on other platforms. 1395 * 1396 * At least some of them have values, on at least one platform, 1397 * that collide with other DLT_* codes on other platforms, e.g. 1398 * DLT_LOOP, so we don't just define them, on all platforms, 1399 * as having the same value as on the original platform. 1400 * 1401 * Therefore, we assigned new LINKTYPE_* codes to them, and, 1402 * on the platforms where they weren't originally defined, 1403 * define the DLT_* codes to have the same value as the 1404 * corresponding LINKTYPE_* codes. 1405 * 1406 * This means that, for capture files with the original 1407 * platform's DLT_* code rather than the LINKTYPE_* code 1408 * as a link-layer type, we will recognize those types 1409 * on that platform, but not on other platforms. 1410 */ 1411 #ifdef DLT_FR 1412 /* BSD/OS Frame Relay */ 1413 if (dlt == DLT_FR) 1414 return (LINKTYPE_FRELAY); 1415 #endif 1416 #if DLT_HDLC != LINKTYPE_NETBSD_HDLC 1417 /* NetBSD HDLC */ 1418 if (dlt == DLT_HDLC) 1419 return (LINKTYPE_NETBSD_HDLC); 1420 #endif 1421 #if DLT_C_HDLC != LINKTYPE_C_HDLC 1422 /* BSD/OS Cisco HDLC */ 1423 if (dlt == DLT_C_HDLC) 1424 return (LINKTYPE_C_HDLC); 1425 #endif 1426 #if DLT_LOOP != LINKTYPE_LOOP 1427 /* OpenBSD DLT_LOOP */ 1428 if (dlt == DLT_LOOP) 1429 return (LINKTYPE_LOOP); 1430 #endif 1431 #if DLT_ENC != LINKTYPE_ENC 1432 /* OpenBSD DLT_ENC */ 1433 if (dlt == DLT_ENC) 1434 return (LINKTYPE_ENC); 1435 #endif 1436 1437 /* 1438 * These DLT_* codes are not on all platforms, but, so far, 1439 * there don't appear to be any platforms that define 1440 * other codes with those values; we map them to 1441 * different LINKTYPE_* codes anyway, just in case. 1442 */ 1443 /* Linux ATM Classical IP */ 1444 if (dlt == DLT_ATM_CLIP) 1445 return (LINKTYPE_ATM_CLIP); 1446 1447 /* 1448 * A few other values, defined on some platforms, not in 1449 * either matching range, but not colliding with anything 1450 * else, so they're given the same LINKTYPE_* code as 1451 * their DLT_* code. 1452 */ 1453 if (dlt == DLT_REDBACK_SMARTEDGE || dlt == DLT_PPP_SERIAL || 1454 dlt == DLT_PPP_ETHER || dlt == DLT_SYMANTEC_FIREWALL) 1455 return (dlt); 1456 1457 /* 1458 * If we don't have a mapping for this DLT_* code, return an 1459 * error; that means that this is a DLT_* value with no 1460 * corresponding LINKTYPE_ value, and we need to assign one. 1461 */ 1462 return (-1); 1463 } 1464 1465 /* 1466 * Map a LINKTYPE_* code to the corresponding DLT_* code. 1467 * Used to translate link-layer types in savefiles to the 1468 * DLT_* codes to provide to callers of libpcap. 1469 */ 1470 int 1471 linktype_to_dlt(int linktype) 1472 { 1473 /* 1474 * All values in the low matching range were handed out before 1475 * assigning DLT_* codes became a free-for-all, so they're the 1476 * same on all platforms, and are thus used as the LINKTYPE_* 1477 * codes in capture files. 1478 */ 1479 if (linktype >= LINKTYPE_LOW_MATCHING_MIN && 1480 linktype <= LINKTYPE_LOW_MATCHING_MAX) 1481 return (linktype); 1482 1483 #if LINKTYPE_PFSYNC != DLT_PFSYNC 1484 /* 1485 * DLT_PFSYNC has a code on several platforms that's in the 1486 * non-matching range, a code on FreeBSD that's in the high 1487 * matching range and that's *not* equal to LINKTYPE_PFSYNC, 1488 * and has a code on the rmaining platforms that's equal 1489 * to LINKTYPE_PFSYNC, which is in the high matching range. 1490 * 1491 * Map LINKTYPE_PFSYNC to whatever DLT_PFSYNC is on this 1492 * platform, if the two aren't equal. 1493 */ 1494 if (linktype == LINKTYPE_PFSYNC) 1495 return (DLT_PFSYNC); 1496 #endif 1497 1498 /* 1499 * DLT_PKTAP is defined as DLT_USER2 - which is in the high 1500 * matching range - on Darwin because Apple used DLT_USER2 1501 * on systems that users ran, not just as an internal thing. 1502 * 1503 * We map LINKTYPE_PKTAP to the platform's DLT_PKTAP for 1504 * the benefit of software that's expecting DLT_PKTAP 1505 * (even if that's DLT_USER2) for an Apple PKTAP capture. 1506 * 1507 * (Yes, this is an annoyance if you want to read a 1508 * LINKTYPE_USER2 packet as something other than DLT_PKTAP 1509 * on a Darwin-based OS, as, on that OS, DLT_PKTAP and DLT_USER2 1510 * are the same. Feel free to complain to Apple about this.) 1511 */ 1512 #if LINKTYPE_PKTAP != DLT_PKTAP 1513 if (linktype == LINKTYPE_PKTAP) 1514 return (DLT_PKTAP); 1515 #endif 1516 1517 /* 1518 * These DLT_* codes have different values on different 1519 * platforms, so we assigned them LINKTYPE_* codes just 1520 * below the lower bound of the high matching range; 1521 * those values should never be equal to any DLT_* 1522 * code, so that should avoid collisions. 1523 * 1524 * That way, for example, "raw IP" packets will have 1525 * LINKTYPE_RAW as the code in all savefiles for 1526 * which the code that writes them maps to that 1527 * value, regardless of the platform on which they 1528 * were written, so they should be readable on all 1529 * platforms without having to determine on which 1530 * platform they were written. 1531 * 1532 * We map the LINKTYPE_* codes to the corresponding 1533 * DLT_* code on this platform. 1534 */ 1535 if (linktype == LINKTYPE_ATM_RFC1483) 1536 return (DLT_ATM_RFC1483); 1537 if (linktype == LINKTYPE_RAW) 1538 return (DLT_RAW); 1539 if (linktype == LINKTYPE_SLIP_BSDOS) 1540 return (DLT_SLIP_BSDOS); 1541 if (linktype == LINKTYPE_PPP_BSDOS) 1542 return (DLT_PPP_BSDOS); 1543 1544 /* 1545 * These DLT_* codes were originally defined on some platform, 1546 * and weren't defined on other platforms. 1547 * 1548 * At least some of them have values, on at least one platform, 1549 * that collide with other DLT_* codes on other platforms, e.g. 1550 * DLT_LOOP, so we don't just define them, on all platforms, 1551 * as having the same value as on the original platform. 1552 * 1553 * Therefore, we assigned new LINKTYPE_* codes to them, and, 1554 * on the platforms where they weren't originally defined, 1555 * define the DLT_* codes to have the same value as the 1556 * corresponding LINKTYPE_* codes. 1557 * 1558 * This means that, for capture files with the original 1559 * platform's DLT_* code rather than the LINKTYPE_* code 1560 * as a link-layer type, we will recognize those types 1561 * on that platform, but not on other platforms. 1562 * 1563 * We map the LINKTYPE_* codes to the corresponding 1564 * DLT_* code on platforms where the two codes differ.. 1565 */ 1566 #ifdef DLT_FR 1567 /* BSD/OS Frame Relay */ 1568 if (linktype == LINKTYPE_FRELAY) 1569 return (DLT_FR); 1570 #endif 1571 #if LINKTYPE_NETBSD_HDLC != DLT_HDLC 1572 /* NetBSD HDLC */ 1573 if (linktype == LINKTYPE_NETBSD_HDLC) 1574 return (DLT_HDLC); 1575 #endif 1576 #if LINKTYPE_C_HDLC != DLT_C_HDLC 1577 /* BSD/OS Cisco HDLC */ 1578 if (linktype == LINKTYPE_C_HDLC) 1579 return (DLT_C_HDLC); 1580 #endif 1581 #if LINKTYPE_LOOP != DLT_LOOP 1582 /* OpenBSD DLT_LOOP */ 1583 if (linktype == LINKTYPE_LOOP) 1584 return (DLT_LOOP); 1585 #endif 1586 #if LINKTYPE_ENC != DLT_ENC 1587 /* OpenBSD DLT_ENC */ 1588 if (linktype == LINKTYPE_ENC) 1589 return (DLT_ENC); 1590 #endif 1591 1592 /* 1593 * These DLT_* codes are not on all platforms, but, so far, 1594 * there don't appear to be any platforms that define 1595 * other codes with those values; we map them to 1596 * different LINKTYPE_* values anyway, just in case. 1597 * 1598 * LINKTYPE_ATM_CLIP is a special case. DLT_ATM_CLIP is 1599 * not on all platforms, but, so far, there don't appear 1600 * to be any platforms that define it as anything other 1601 * than 19; we define LINKTYPE_ATM_CLIP as something 1602 * other than 19, just in case. That value is in the 1603 * high matching range, so we have to check for it. 1604 */ 1605 /* Linux ATM Classical IP */ 1606 if (linktype == LINKTYPE_ATM_CLIP) 1607 return (DLT_ATM_CLIP); 1608 1609 /* 1610 * For all other values, return the linktype code as the 1611 * DLT_* code. 1612 * 1613 * If the code is in the high matching range, the 1614 * DLT_* code is the same as the LINKTYPE_* code. 1615 * 1616 * If the code is greater than the maximum value in 1617 * the high matching range, it may be a value from 1618 * a newer version of libpcap; we provide it in case 1619 * the program' capable of handling it. 1620 * 1621 * If the code is less than the minimum value in the 1622 * high matching range, it might be from a capture 1623 * written by code that doesn't map non-matching range 1624 * DLT_* codes to the appropriate LINKTYPE_* code, so 1625 * we'll just pass it through, so that *if it was written 1626 * on this platform* it will be interpreted correctly. 1627 * (We don't know whether it was written on this platform, 1628 * but at least this way there's *some* chance that it 1629 * can be read.) 1630 */ 1631 return linktype; 1632 } 1633 1634 /* 1635 * Return the maximum snapshot length for a given DLT_ value. 1636 * 1637 * For most link-layer types, we use MAXIMUM_SNAPLEN. 1638 * 1639 * For DLT_DBUS, the maximum is 128MiB, as per 1640 * 1641 * https://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages 1642 * 1643 * For DLT_EBHSCR, the maximum is 8MiB, as per 1644 * 1645 * https://www.elektrobit.com/ebhscr 1646 * 1647 * For DLT_USBPCAP, the maximum is 1MiB, as per 1648 * 1649 * https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15985 1650 */ 1651 u_int 1652 max_snaplen_for_dlt(int dlt) 1653 { 1654 switch (dlt) { 1655 1656 case DLT_DBUS: 1657 return 128*1024*1024; 1658 1659 case DLT_EBHSCR: 1660 return 8*1024*1024; 1661 1662 case DLT_USBPCAP: 1663 return 1024*1024; 1664 1665 default: 1666 return MAXIMUM_SNAPLEN; 1667 } 1668 } 1669
Indexes created Mon Jun 22 00:25:11 UTC 2026