[prev in list] [next in list] [prev in thread] [next in thread] 

List:       tcpdump-workers
Subject:    Re: [tcpdump-workers] LINKTYPE_LINUX_SLL2 implementation (libpcap & tcpdump)
From:       Guy Harris <gharris () sonic ! net>
Date:       2018-07-11 22:12:34
Message-ID: 8B2F4D26-A18A-4BE7-99F6-EB80869B870B () sonic ! net
[Download RAW message or body]

Note, by the way, that, for memory-mapped captures, the Linux kernel appears, in \
tpacket_rcv(), to reserve 16 octets of extra space, which is exactly enough to insert \
a DLT_LINUX_SLL header, but not enough for a DLT_LINUX_SLL2 header (and wouldn't even \
be enough if we *didn't* pad it to put the interface index on a 4-byte boundary):

	if (sk->sk_type == SOCK_DGRAM) {
		macoff = netoff = TPACKET_ALIGN(po->tp_hdrlen) + 16 +
				  po->tp_reserve;
	} else {
		unsigned int maclen = skb_network_offset(skb);
		netoff = TPACKET_ALIGN(po->tp_hdrlen +
				       (maclen < 16 ? 16 : maclen)) +
			po->tp_reserve;
		macoff = netoff - maclen;
	}

so to support LINKTYPE_LINUX_SLL2 you'd have to add 4 bytes to the tp_reserve value, \
which is done with the PACKET_RESERVE, and that's not supported on all kernels, so, \
in order to decide whether to support DLT_LINUX_SLL2, you have to check whether you \
can do PACKET_RESERVE or not. _______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers


[prev in list] [next in list] [prev in thread] [next in thread]