With upcoming Linux 3.11, we have the possibility to debug local netlink
traffic [1] i.e. the workflow looks like this:
Setup:
modprobe nlmon
ip link add type nlmon
ip link set nlmon0 up
Capture:
tcpdump -i nlmon0 ...
Teardown:
ip link set nlmon0 down
ip link del dev nlmon0
rmmod nlmon
For pcap interoperability, introduce a common link type for netlink
captures and map to it for ARPHRD_NETLINK.
Signed-off-by: Daniel Borkmann <dbork...@redhat.com>
CC: Thomas Graf <tg...@suug.ch>
CC: Tobias Klauser <tklau...@distanz.ch>
---
v1->v2:
- Do ARPHRD to DLT mapping
- Rebase on latest Git tree
pcap-common.c | 7 ++++++-
pcap-linux.c | 7 +++++++
pcap/bpf.h | 7 ++++++-
3 files changed, 19 insertions(+), 2 deletions(-)
diff --git a/pcap-common.c b/pcap-common.c
index 6175a5a..f26d22e 100644
--- a/pcap-common.c
+++ b/pcap-common.c
@@ -932,7 +932,12 @@
*/
#define LINKTYPE_WIRESHARK_UPPER_PDU 252
-#define LINKTYPE_MATCHING_MAX 252 /* highest value in the
"matching" range */
+/*
+ * Link-layer header type for the netlink protocol (nlmon devices).
+ */
+#define LINKTYPE_NETLINK 253
+
+#define LINKTYPE_MATCHING_MAX 253 /* highest value in the
"matching" range */
static struct linktype_map {
int dlt;
diff --git a/pcap-linux.c b/pcap-linux.c
index 7c14821..ee063ae 100644
--- a/pcap-linux.c
+++ b/pcap-linux.c
@@ -2934,6 +2934,13 @@ static void map_arphrd_to_dlt(pcap_t *handle, int
arptype, int cooked_ok)
handle->linktype = DLT_IEEE802_15_4_NOFCS;
break;
+#ifndef ARPHRD_NETLINK
+#define ARPHRD_NETLINK 824
+#endif
+ case ARPHRD_NETLINK:
+ handle->linktype = DLT_NETLINK;
+ break;
+
default:
handle->linktype = -1;
break;
diff --git a/pcap/bpf.h b/pcap/bpf.h
index ad36eb6..8286ed5 100644
--- a/pcap/bpf.h
+++ b/pcap/bpf.h
@@ -1224,7 +1224,12 @@ struct bpf_program {
*/
#define DLT_WIRESHARK_UPPER_PDU 252
-#define DLT_MATCHING_MAX 252 /* highest value in the "matching"
range */
+/*
+ * DLT type for the netlink protocol (nlmon devices).
+ */
+#define DLT_NETLINK 253
+
+#define DLT_MATCHING_MAX 253 /* highest value in the "matching"
range */
/*
* DLT and savefile link type values are split into a class and
--
1.7.11.7
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
