On Fri, Jun 19, 2015 at 11:13:54PM +0200, Daniel Borkmann wrote:
> On 06/19/2015 10:58 PM, Vadim Kochan wrote:
> >On Fri, Jun 19, 2015 at 10:47:49PM +0200, Daniel Borkmann wrote:
> ...
> >>@@ -737,6 +837,24 @@ static inline void pcap_validate_header(const struct
> >>pcap_filehdr *hdr)
> >> if (unlikely(hdr->version_minor != PCAP_VERSION_MINOR) &&
> >> ___constant_swab16(hdr->version_minor) !=
> >> PCAP_VERSION_MINOR)
> >> panic("This file has an invalid pcap minor version (must be
> >> %d)\n", PCAP_VERSION_MINOR);
> >>+
> >>+ /* Remap to internal *_LL types in case of LINKTYPE_LINUX_SLL. */
> >>+ if (linktype == LINKTYPE_LINUX_SLL) {
> >should not link_has_sll_hdr() be used here ?
>
> Why? At this point, when reading a pcap file, basic validation has already
> been done and linktype is in host endianess. In netsniff-ng, we write out
> the pcap header as LINKTYPE_LINUX_SLL in case of Netlink.
>
> In case some other source doesn't use LINKTYPE_LINUX_SLL but LINKTYPE_NETLINK,
> we actually need not to assume cooked format.
My understanding is that linktype might be set to LINKTYPE_NETLINK if it
was sniffed only from Netlink interface which uses the same sll header
format but with ignoring few fields - address & address len.
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to netsniff-ng+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
