pcap datalink LINUX_SLL

Question

I'm trying to write a simple packet sniffer using libpcap. The first thing i'm trying to do when i capture a packet is to recognise the datalink protocol used and find the size of the header for that protocol in order to find the ip packet. The problem is that sometimes libpcap returns as datalink layer protocol the LINUX_SLL which is described as "Linux cooked" does anyone know the format of the headers for that protocol? or at least the size of the header.

Thanks a lot Giorgos

Answer 1

Or check the new tcpdump.org "link-layer header types" page for descriptions of the link-layer types.

Answer 2

I think this will solve your problem for good: http://wiki.wireshark.org/SLL

Better yet, use Wireshark to read the pcap and it will show you the field types and their size.

Answer 3

 /*
 * A DLT_LINUX_SLL fake link-layer header.
 */
#define SLL_HDR_LEN 16      /* total header length */
#define SLL_ADDRLEN 8       /* length of address field */

struct sll_header {
    uint16_t sll_pkttype;       /* packet type */
    uint16_t sll_hatype;        /* link-layer address type */
    uint16_t sll_halen;     /* link-layer address length */
    uint8_t  sll_addr[SLL_ADDRLEN]; /* link-layer address */
    uint16_t sll_protocol;      /* protocol */
};

/*
 * A DLT_LINUX_SLL2 fake link-layer header.
 */
#define SLL2_HDR_LEN    20      /* total header length */

struct sll2_header {
    uint16_t sll2_protocol;         /* protocol */
    uint16_t sll2_reserved_mbz;     /* reserved - must be zero */
    uint32_t sll2_if_index;         /* 1-based interface index */
    uint16_t sll2_hatype;           /* link-layer address type */
    uint8_t  sll2_pkttype;          /* packet type */
    uint8_t  sll2_halen;            /* link-layer address length */
    uint8_t  sll2_addr[SLL_ADDRLEN];    /* link-layer address */
};