Re: LINKTYPE_LINUX_SLL2 implementation (libpcap & tcpdump)

[Guy Harris <gharris () sonic net>]

Note, by the way, that, for memory-mapped captures, the Linux kernel appears, in tpacket_rcv(), to reserve 16 octets of 
extra space, which is exactly enough to insert a DLT_LINUX_SLL header, but not enough for a DLT_LINUX_SLL2 header (and 
wouldn't even be enough if we *didn't* pad it to put the interface index on a 4-byte boundary):

        if (sk->sk_type == SOCK_DGRAM) {
                macoff = netoff = TPACKET_ALIGN(po->tp_hdrlen) + 16 +
                                  po->tp_reserve;
        } else {
                unsigned int maclen = skb_network_offset(skb);
                netoff = TPACKET_ALIGN(po->tp_hdrlen +
                                       (maclen < 16 ? 16 : maclen)) +
                        po->tp_reserve;
                macoff = netoff - maclen;
        }

so to support LINKTYPE_LINUX_SLL2 you'd have to add 4 bytes to the tp_reserve value, which is done with the 
PACKET_RESERVE, and that's not supported on all kernels, so, in order to decide whether to support DLT_LINUX_SLL2, you 
have to check whether you can do PACKET_RESERVE or not.
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers