From owner-freebsd-hackers Wed Jul 29 13:45:23 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id NAA24040 for freebsd-hackers-outgoing; Wed, 29 Jul 1998 13:45:23 -0700 (PDT) (envelope-from owner-freebsd-hackers@FreeBSD.ORG) Received: from verdi.nethelp.no (verdi.nethelp.no [158.36.41.162]) by hub.freebsd.org (8.8.8/8.8.8) with SMTP id NAA24011 for ; Wed, 29 Jul 1998 13:45:08 -0700 (PDT) (envelope-from sthaug@nethelp.no) From: sthaug@nethelp.no Received: (qmail 3932 invoked by uid 1001); 29 Jul 1998 20:44:27 +0000 (GMT) To: jlemon@americantv.com Cc: dennis@etinc.com, hackers@FreeBSD.ORG Subject: Re: TCPDUMP In-Reply-To: Your message of "Tue, 28 Jul 1998 13:34:30 -0500" References: <19980728133430.54771@right.PCS> X-Mailer: Mew version 1.05+ on Emacs 19.34.2 Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Date: Wed, 29 Jul 1998 22:44:27 +0200 Message-ID: <3930.901745067@verdi.nethelp.no> Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG > > Does anyone who understand the bpf code have an idea why filters > > (and trafshow) done work with a serial device with DLT_NULL header? > > > > tcpdump works fine in raw mode, but if you ad an expression it > > doesnt pass the filter tests. > > Not sure, but you may want to look at src/contrib/libpcap/gencode.c, > at the various switch statements for DLT_NULL. Perhaps the offsets > are not correct the framing protocol that you are using? Yup. DLT_NULL simply has the wrong semantics. It can be kludged, but that requires recompiling libpcap, and commenting out the special case for DLT_NULL in gen_linktype() (patch relative to libpcap-0.4a6): *** gencode.c.orig Thu Jun 12 23:23:01 1997 --- gencode.c Wed Jul 29 20:42:22 1998 *************** *** 607,618 **** --- 607,620 ---- } break; + #if 0 case DLT_NULL: /* XXX */ if (proto == ETHERTYPE_IP) return (gen_cmp(0, BPF_W, (bpf_int32)htonl(AF_INET))); else return gen_false(); + #endif } return gen_cmp(off_linktype, BPF_H, (bpf_int32)proto); } You also have to make sure that your type field is in the first two bytes of the 4-byte DLT_NULL header, in network byte order. Why is DLT_NULL wrong? From looking at the tcpdump/libpcap source code, it looks like it's meant to be used with Irix and Linux, and libcap explicitly checks for AF_INET. Also, it's a 4 byte field. What we'd like to have, is a two byte field - basically the standard Ethernet type, minus source and destination addresses. This needs to be done in cooperation with the tcpdump maintainers, of course. Steinar Haug, Nethelp consulting, sthaug@nethelp.no To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message