From: Vadim Kochan <vadi...@gmail.com> This series adds supporting of Linux "cooked" header
http://www.tcpdump.org/linktypes/LINKTYPE_NETLINK.html which is compatible with Wireshark. Also it can be dissected by new dissector_sll.c while dumping. Needs to test on archs's with different byte ordering. 1) Add suporting Linux "cooked" header. Added -w,--cooked option which replaces L2 header frame with cooked header for each frame and allows to dump & dissect Ethernet & Netlink packets together. Linux "cooked" header is automatically used for Netlink link type for the other cases (for -i any) it needs to specify "--cooked" option. Used dgram packet socket when sniffing with "--cooked" option to pull L2 header and wrap packet with Linux "cooked" header, it allows compatibility with Wireshark. 2) Added dissector_sll.c to dissect packets with Linux "cooked" header. Meanwhile it can dump only Netlink & Ethernet protos (L3 layer). This dissector is used if link type is LINKTYPE_LINUX_SLL. Vadim Kochan (2): netsniff-ng: Add support of Linux "cooked" header netsniff-ng: Add dissector for Linux "cooked" packets dev.c | 2 +- dev.h | 4 +- dissector.c | 12 +- dissector.h | 2 +- dissector_sll.c | 113 ++++++++++++++ dissector_sll.h | 18 +++ linktype.h | 1 + netsniff-ng.8 | 12 +- netsniff-ng.c | 36 ++++- netsniff-ng/Makefile | 1 + pcap_io.h | 409 ++++++++++++++++++++++++++++++++------------------- pcap_mm.c | 5 +- pcap_rw.c | 4 +- pcap_sg.c | 8 +- pkt_buff.h | 2 +- proto_nlmsg.c | 4 +- sock.c | 10 ++ sock.h | 1 + 18 files changed, 466 insertions(+), 178 deletions(-) create mode 100644 dissector_sll.c create mode 100644 dissector_sll.h -- 2.4.2 -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to netsniff-ng+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.