On Thu, Mar 01, 2001 at 11:31:24PM -0800, Guy Harris wrote:
> > > So would it ever be the case that a packet capture would be a
> > > DLT_RAWAF(AF_xxx) capture?
> >
> > DLT_RAWAF() is named as it is to indicate that AF_xxx should be used
> > with it. But *any* AF_xxx constant may be used. AF_INET, AF_INET6,
> > AF_DECNET, whatever.
> >
> > > If so, then we'd want to arrange to have platform-independent versions
> > > of the DLT_RAWAF() values, to put in the capture file header, so that,
> > > for example, a DLT_RAWAF(AF_INET6) capture would have the same
> > > link-layer type in the header, regardless of which particular OS the
> > > capture was done on.
> >
> > OIC -- for pcap_file_header's linktype field -- I forgot all about that,
> > really.
So would it ever be the case that BIOCGDLT would return one of the
DLT_RAWAF() values? If so, in addition to providing platform-independent
linktype field values for various AF_xxx values, we'd also have to make
tcpdump dissect them....
Or would a link type of DLT_RAWAF(AF_xxx) only show up if the program
uses "pcap_compile_nopcap()" or "pcap_open_dead()", so that it can
compile a filter expression into BPF code for various types of
addresses?
If the latter, there's no need for platform-independent capture-file
linktype values for DLT_RAWAF.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
