On 27/03/09 07:01 PM, Sebastien Roy wrote:
Hi Darren,
On Fri, 2009-03-27 at 10:58 -0700, Darren Reed wrote:
Additionally, I'm considering creating a new datalink type for loopback
packets on OpenSolaris. The contents would be something like:
version (16 bits: 1)
protocol family (16 bits: AF_INET, AF_INET6)
capture point (32bits enum: local, in, out)
interface index (32bits)
group interface index (32bits)
source zone (32 or 64bits?)
destination zone (32 or 64bits?)
I'm guessing that this should be called DLT_LOOP_SOLARIS.
There is already a datalink type associated with loopback (/dev/lo0),
DL_IPNET, and the header is described in the lo0(7D) man page. It's
versioned, so it would be technically possible to evolve it to include
more information.
The only hitch is that DL_IPNET devices behave like DLT_RAW by default.
The DL_IOC_IPNET_INFO ioctl enables the inclusion of the "ipnet" header.
The thinking here was that with a tiny modification to libpcap, existing
applications that understand DLT_RAW could read packets off of DL_IPNET
devices. The downside is that we now can't really have libpcap turn on
DL_IOC_IPNET_INFO if such applications assume that these devices are
DLT_RAW. Perhaps it would be simpler if we got rid of DL_IOC_IPNET_INFO
and had DL_IPNET devices always include the header. Since the
Solaris-specific snoop application is the only thing that currently uses
the ioctl, it's a change that could be manageable. This is something
we'd need to discuss with the OpenSolaris networking community first,
though.
I'm not intending to change anything with respect to DLPI, so
DL_IOC_IPNET_INFO is not of any concern to me. DL_IPNET doesn't exist
outside of the Solaris source code base, so it seems to me to still be a
private thing, which is fine.
What I am considering is:
- moving libpcap on Solaris to use /dev/bpf rather than libdlpi
- extending the libpcap parser to grok keywords that related to things
in the "loopback" header
- publishing the extra datalink type via BPF so you can select them with
tcpdump, like you do with 802.11 on BSD to get radio frames, not
ethernet frames
- with respect to all of the above, it may be beneficial to keep
DL_IPNET as a private header type for libdlpi to use when opening
/dev/ipnet things, the further away I can stay from snoop the better.
Darren
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.