On Sat, Aug 04, 2001 at 10:37:45AM +0200, Rafal Wojtczuk wrote:
> BTW, if we know the data link type, is there a simple way to determine the
> link layer header size (other than manually checking each physical medium
> documentation ?)
No.
> If not (I think not) is there an authoritative document
> defining (DLT_* data link type) -> (header size) function ?
No.
What would be needed is an authoritative document giving, for each data
link type, either
1) a *full description* of the header (some programs need more
than just the link-layer header size, they need to know
what's *in* the header; in fact, a program that cares only
about the link-layer header size will work only if, for
example, all traffic is IPv4 or IPv6 traffic, as, if they
don't look at fields in the link-layer header, they won't be
able to tell IP packets from ARP packets, say)
or
2) a reference to the appropriate link-layer spec (which
presumably contains said full description).
For some link-layer headers, 2) is impossible, as the "link-layer"
header is really a synthetic header (DLT_NULL, DLT_LOOP, and
DLT_LINUX_SLL, for example). I'm not sure it's worth putting the full
description of the header in said document for link-layer types where 2)
is possible, though.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
