On Fri, Sep 07, 2001 at 03:07:42PM -0700, Guy Harris wrote:
> If you do so, please use 116 as the value for that DLT_ name, and send
> us the name you chose (e.g., DLT_IPFILTER). Otherwise, we can't
> guarantee that the value won't later be assigned to some other DLT_
> name.
>
> The way you add support to it in the pcap compiler is:
I've attached a patch to the current CVS version of libpcap that uses
116 rather than 115 for DLT_IPFILTER and that should generate correct
code for filter expressions (although I didn't add support for "inbound"
and "outbound").
Index: gencode.c
===================================================================
RCS file: /tcpdump/master/libpcap/gencode.c,v
retrieving revision 1.157
diff -c -r1.157 gencode.c
*** gencode.c 2001/07/03 19:15:47 1.157
--- gencode.c 2001/09/09 04:35:00
***************
*** 703,708 ****
--- 703,716 ----
off_linktype = -1;
off_nl = 0;
return;
+
+ case DLT_IPFILTER:
+ /*
+ * All IP Filter packets are IP packets.
+ */
+ off_linktype = -1;
+ off_nl = 32;
+ return;
}
bpf_error("unknown data link type %d", linktype);
/* NOTREACHED */
***************
*** 1165,1170 ****
--- 1173,1179 ----
case DLT_SLIP:
case DLT_SLIP_BSDOS:
case DLT_RAW:
+ case DLT_IPFILTER:
/*
* These types don't provide any type field; packets
* are always IP.
Index: pcap-int.h
===================================================================
RCS file: /tcpdump/master/libpcap/pcap-int.h,v
retrieving revision 1.33
diff -c -r1.33 pcap-int.h
*** pcap-int.h 2001/08/24 07:46:52 1.33
--- pcap-int.h 2001/09/09 04:35:01
***************
*** 202,207 ****
--- 202,210 ----
int install_bpf_program(pcap_t *, struct bpf_program *);
+ /* savefile public routines */
+ int sf_write_header(FILE *, int, int, int);
+
#ifdef __cplusplus
}
#endif
Index: savefile.c
===================================================================
RCS file: /tcpdump/master/libpcap/savefile.c,v
retrieving revision 1.53
diff -c -r1.53 savefile.c
*** savefile.c 2001/09/09 04:27:18 1.53
--- savefile.c 2001/09/09 04:35:02
***************
*** 163,168 ****
--- 163,169 ----
#define LINKTYPE_LINUX_SLL 113 /* Linux cooked socket capture */
#define LINKTYPE_LTALK 114 /* Apple LocalTalk hardware */
#define LINKTYPE_ECONET 115 /* Acorn Econet */
+ #define LINKTYPE_IPFILTER 116 /* IP Filter capture files */
/*
* These types are reserved for future use.
***************
*** 238,243 ****
--- 239,247 ----
/* Acorn Econet */
{ DLT_ECONET, LINKTYPE_ECONET },
+ /* IP Filter capture files */
+ { DLT_IPFILTER, LINKTYPE_IPFILTER },
+
/*
* Any platform that defines additional DLT_* codes should:
*
***************
*** 295,301 ****
return linktype;
}
! static int
sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen)
{
struct pcap_file_header hdr;
--- 299,305 ----
return linktype;
}
! int
sf_write_header(FILE *fp, int linktype, int thiszone, int snaplen)
{
struct pcap_file_header hdr;
Index: bpf/net/bpf.h
===================================================================
RCS file: /tcpdump/master/libpcap/bpf/net/bpf.h,v
retrieving revision 1.48
diff -c -r1.48 bpf.h
*** bpf.h 2001/09/09 04:27:19 1.48
--- bpf.h 2001/09/09 04:35:03
***************
*** 283,288 ****
--- 283,293 ----
#define DLT_ECONET 115
/*
+ * IP Filter format
+ */
+ #define DLT_IPFILTER 116
+
+ /*
* The instruction encodings.
*/
/* instruction classes */
