Project

General

Profile

Statistics
| Revision:

root / lab4 / .minix-src / include / net / dlt.h @ 13

History | View | Annotate | Download (40.7 KB)

1
/*        $NetBSD: dlt.h,v 1.16 2015/03/31 21:42:16 christos Exp $        */
2

    
3
/*-
4
 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
5
 *        The Regents of the University of California.  All rights reserved.
6
 *
7
 * This code is derived from the Stanford/CMU enet packet filter,
8
 * (net/enet.c) distributed as part of 4.3BSD, and code contributed
9
 * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
10
 * Berkeley Laboratory.
11
 *
12
 * Redistribution and use in source and binary forms, with or without
13
 * modification, are permitted provided that the following conditions
14
 * are met:
15
 * 1. Redistributions of source code must retain the above copyright
16
 *    notice, this list of conditions and the following disclaimer.
17
 * 2. Redistributions in binary form must reproduce the above copyright
18
 *    notice, this list of conditions and the following disclaimer in the
19
 *    documentation and/or other materials provided with the distribution.
20
 * 3. All advertising materials mentioning features or use of this software
21
 *    must display the following acknowledgement:
22
 *      This product includes software developed by the University of
23
 *      California, Berkeley and its contributors.
24
 * 4. Neither the name of the University nor the names of its contributors
25
 *    may be used to endorse or promote products derived from this software
26
 *    without specific prior written permission.
27
 *
28
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
29
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
30
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
31
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
32
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
33
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
34
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
35
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
36
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
37
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38
 * SUCH DAMAGE.
39
 *
40
 *      @(#)bpf.h       7.1 (Berkeley) 5/7/91
41
 *
42
 * @(#) Header: /tcpdump/master/libpcap/pcap/bpf.h,v 1.32 2008-12-23 20:13:29 guy Exp  (LBL)
43
 */
44

    
45
#ifndef _NET_DLT_H_
46
#define _NET_DLT_H_
47
/*
48
 * Link-layer header type codes.
49
 *
50
 * Do *NOT* add new values to this list without asking
51
 * "tcpdump-workers@lists.tcpdump.org" for a value.  Otherwise, you run
52
 * the risk of using a value that's already being used for some other
53
 * purpose, and of having tools that read libpcap-format captures not
54
 * being able to handle captures with your new DLT_ value, with no hope
55
 * that they will ever be changed to do so (as that would destroy their
56
 * ability to read captures using that value for that other purpose).
57
 *
58
 * See
59
 *
60
 *        http://www.tcpdump.org/linktypes.html
61
 *
62
 * for detailed descriptions of some of these link-layer header types.
63
 */
64

    
65
/*
66
 * These are the types that are the same on all platforms, and that
67
 * have been defined by <net/bpf.h> for ages.
68
 */
69
#define DLT_NULL        0        /* BSD loopback encapsulation */
70
#define DLT_EN10MB        1        /* Ethernet (10Mb) */
71
#define DLT_EN3MB        2        /* Experimental Ethernet (3Mb) */
72
#define DLT_AX25        3        /* Amateur Radio AX.25 */
73
#define DLT_PRONET        4        /* Proteon ProNET Token Ring */
74
#define DLT_CHAOS        5        /* Chaos */
75
#define DLT_IEEE802        6        /* 802.5 Token Ring */
76
#define DLT_ARCNET        7        /* ARCNET, with BSD-style header */
77
#define DLT_SLIP        8        /* Serial Line IP */
78
#define DLT_PPP                9        /* Point-to-point Protocol */
79
#define DLT_FDDI        10        /* FDDI */
80

    
81
/*
82
 * These are types that are different on some platforms, and that
83
 * have been defined by <net/bpf.h> for ages.  We use #ifdefs to
84
 * detect the BSDs that define them differently from the traditional
85
 * libpcap <net/bpf.h>
86
 *
87
 * XXX - DLT_ATM_RFC1483 is 13 in BSD/OS, and DLT_RAW is 14 in BSD/OS,
88
 * but I don't know what the right #define is for BSD/OS.
89
 */
90
#define DLT_ATM_RFC1483        11        /* LLC-encapsulated ATM */
91

    
92
#ifdef __OpenBSD__
93
#define DLT_RAW                14        /* raw IP */
94
#else
95
#define DLT_RAW                12        /* raw IP */
96
#endif
97

    
98
/*
99
 * Given that the only OS that currently generates BSD/OS SLIP or PPP
100
 * is, well, BSD/OS, arguably everybody should have chosen its values
101
 * for DLT_SLIP_BSDOS and DLT_PPP_BSDOS, which are 15 and 16, but they
102
 * didn't.  So it goes.
103
 */
104
#if defined(__NetBSD__) || defined(__FreeBSD__)
105
#ifndef DLT_SLIP_BSDOS
106
#define DLT_SLIP_BSDOS        13        /* BSD/OS Serial Line IP */
107
#define DLT_PPP_BSDOS        14        /* BSD/OS Point-to-point Protocol */
108
#define DLT_HIPPI        15        /* HIPPI */
109
#define DLT_HDLC        16        /* HDLC framing */
110
#endif
111
#else
112
#define DLT_SLIP_BSDOS        15        /* BSD/OS Serial Line IP */
113
#define DLT_PPP_BSDOS        16        /* BSD/OS Point-to-point Protocol */
114
#endif
115

    
116
/*
117
 * 17 was used for DLT_PFLOG in OpenBSD; it no longer is.
118
 *
119
 * It was DLT_LANE8023 in SuSE 6.3, so we defined LINKTYPE_PFLOG
120
 * as 117 so that pflog captures would use a link-layer header type
121
 * value that didn't collide with any other values.  On all
122
 * platforms other than OpenBSD, we defined DLT_PFLOG as 117,
123
 * and we mapped between LINKTYPE_PFLOG and DLT_PFLOG.
124
 *
125
 * OpenBSD eventually switched to using 117 for DLT_PFLOG as well.
126
 *
127
 * Don't use 17 for anything else.
128
 */
129
#if defined(__OpenBSD__) || defined(__NetBSD__)
130
#define DLT_OLD_PFLOG        17
131
#endif
132

    
133
/*
134
 * 18 is used for DLT_PFSYNC in OpenBSD, NetBSD, DragonFly BSD and
135
 * Mac OS X; don't use it for anything else.  (FreeBSD uses 121,
136
 * which collides with DLT_HHDLC, even though it doesn't use 18
137
 * for anything and doesn't appear to have ever used it for anything.)
138
 *
139
 * We define it as 18 on those platforms; it is, unfortunately, used
140
 * for DLT_CIP in Suse 6.3, so we don't define it as DLT_PFSYNC
141
 * in general.  As the packet format for it, like that for
142
 * DLT_PFLOG, is not only OS-dependent but OS-version-dependent,
143
 * we don't support printing it in tcpdump except on OSes that
144
 * have the relevant header files, so it's not that useful on
145
 * other platforms.
146
 */
147
#if defined(__OpenBSD__) || defined(__NetBSD__) || defined(__DragonFly__) || defined(__APPLE__)
148
#define DLT_PFSYNC        18
149
#endif
150

    
151
#define DLT_ATM_CLIP        19        /* Linux Classical-IP over ATM */
152

    
153
/*
154
 * Apparently Redback uses this for its SmartEdge 400/800.  I hope
155
 * nobody else decided to use it, too.
156
 */
157
#define DLT_REDBACK_SMARTEDGE        32
158

    
159
/*
160
 * These values are defined by NetBSD; other platforms should refrain from
161
 * using them for other purposes, so that NetBSD savefiles with link
162
 * types of 50 or 51 can be read as this type on all platforms.
163
 */
164
#define DLT_PPP_SERIAL        50        /* PPP over serial with HDLC encapsulation */
165
#define DLT_PPP_ETHER        51        /* PPP over Ethernet */
166

    
167
/*
168
 * The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses
169
 * a link-layer type of 99 for the tcpdump it supplies.  The link-layer
170
 * header has 6 bytes of unknown data, something that appears to be an
171
 * Ethernet type, and 36 bytes that appear to be 0 in at least one capture
172
 * I've seen.
173
 */
174
#define DLT_SYMANTEC_FIREWALL        99
175

    
176
/*
177
 * Values between 100 and 103 are used in capture file headers as
178
 * link-layer header type LINKTYPE_ values corresponding to DLT_ types
179
 * that differ between platforms; don't use those values for new DLT_
180
 * new types.
181
 */
182

    
183
/*
184
 * Values starting with 104 are used for newly-assigned link-layer
185
 * header type values; for those link-layer header types, the DLT_
186
 * value returned by pcap_datalink() and passed to pcap_open_dead(),
187
 * and the LINKTYPE_ value that appears in capture files, are the
188
 * same.
189
 *
190
 * DLT_MATCHING_MIN is the lowest such value; DLT_MATCHING_MAX is
191
 * the highest such value.
192
 */
193
#define DLT_MATCHING_MIN        104
194

    
195
/*
196
 * This value was defined by libpcap 0.5; platforms that have defined
197
 * it with a different value should define it here with that value -
198
 * a link type of 104 in a save file will be mapped to DLT_C_HDLC,
199
 * whatever value that happens to be, so programs will correctly
200
 * handle files with that link type regardless of the value of
201
 * DLT_C_HDLC.
202
 *
203
 * The name DLT_C_HDLC was used by BSD/OS; we use that name for source
204
 * compatibility with programs written for BSD/OS.
205
 *
206
 * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
207
 * for source compatibility with programs written for libpcap 0.5.
208
 */
209
#define DLT_C_HDLC        104        /* Cisco HDLC */
210
#define DLT_CHDLC        DLT_C_HDLC
211

    
212
#define DLT_IEEE802_11        105        /* IEEE 802.11 wireless */
213

    
214
/*
215
 * 106 is reserved for Linux Classical IP over ATM; it's like DLT_RAW,
216
 * except when it isn't.  (I.e., sometimes it's just raw IP, and
217
 * sometimes it isn't.)  We currently handle it as DLT_LINUX_SLL,
218
 * so that we don't have to worry about the link-layer header.)
219
 */
220

    
221
/*
222
 * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides
223
 * with other values.
224
 * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header
225
 * (DLCI, etc.).
226
 */
227
#define DLT_FRELAY        107
228

    
229
/*
230
 * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
231
 * that the AF_ type in the link-layer header is in network byte order.
232
 *
233
 * DLT_LOOP is 12 in OpenBSD, but that's DLT_RAW in other OSes, so
234
 * we don't use 12 for it in OSes other than OpenBSD.
235
 */
236
#ifdef __OpenBSD__
237
#define DLT_LOOP        12
238
#else
239
#define DLT_LOOP        108
240
#endif
241

    
242
/*
243
 * Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's
244
 * DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other
245
 * than OpenBSD.
246
 */
247
#ifdef __OpenBSD__
248
#define DLT_ENC                13
249
#else
250
#define DLT_ENC                109
251
#endif
252

    
253
/*
254
 * Values between 110 and 112 are reserved for use in capture file headers
255
 * as link-layer types corresponding to DLT_ types that might differ
256
 * between platforms; don't use those values for new DLT_ types
257
 * other than the corresponding DLT_ types.
258
 */
259

    
260
/*
261
 * This is for Linux cooked sockets.
262
 */
263
#define DLT_LINUX_SLL        113
264

    
265
/*
266
 * Apple LocalTalk hardware.
267
 */
268
#define DLT_LTALK        114
269

    
270
/*
271
 * Acorn Econet.
272
 */
273
#define DLT_ECONET        115
274

    
275
/*
276
 * Reserved for use with OpenBSD ipfilter.
277
 */
278
#define DLT_IPFILTER        116
279

    
280
/*
281
 * OpenBSD DLT_PFLOG.
282
 */
283
#define DLT_PFLOG        117
284

    
285
/*
286
 * Registered for Cisco-internal use.
287
 */
288
#define DLT_CISCO_IOS        118
289

    
290
/*
291
 * For 802.11 cards using the Prism II chips, with a link-layer
292
 * header including Prism monitor mode information plus an 802.11
293
 * header.
294
 */
295
#define DLT_PRISM_HEADER        119
296

    
297
/*
298
 * Reserved for Aironet 802.11 cards, with an Aironet link-layer header
299
 * (see Doug Ambrisko's FreeBSD patches).
300
 */
301
#define DLT_AIRONET_HEADER        120
302

    
303
/*
304
 * Sigh.
305
 *
306
 * This was reserved for Siemens HiPath HDLC on 2002-01-25, as
307
 * requested by Tomas Kukosa.
308
 *
309
 * On 2004-02-25, a FreeBSD checkin to sys/net/bpf.h was made that
310
 * assigned 121 as DLT_PFSYNC.  Its libpcap does DLT_ <-> LINKTYPE_
311
 * mapping, so it probably supports capturing on the pfsync device
312
 * but not saving the captured data to a pcap file.
313
 *
314
 * OpenBSD, from which pf came, however, uses 18 for DLT_PFSYNC;
315
 * their libpcap does no DLT_ <-> LINKTYPE_ mapping, so it would
316
 * use 18 in pcap files as well.
317
 *
318
 * NetBSD and DragonFly BSD also use 18 for DLT_PFSYNC; their
319
 * libpcaps do DLT_ <-> LINKTYPE_ mapping, and neither has an entry
320
 * for DLT_PFSYNC, so it might not be able to write out dump files
321
 * with 18 as the link-layer header type.  (Earlier versions might
322
 * not have done mapping, in which case they'd work the same way
323
 * OpenBSD does.)
324
 *
325
 * Mac OS X defines it as 18, but doesn't appear to use it as of
326
 * Mac OS X 10.7.3.  Its libpcap does DLT_ <-> LINKTYPE_ mapping.
327
 *
328
 * We'll define DLT_PFSYNC as 121 on FreeBSD and define it as 18 on
329
 * all other platforms.  We'll define DLT_HHDLC as 121 on everything
330
 * except for FreeBSD; anybody who wants to compile, on FreeBSD, code
331
 * that uses DLT_HHDLC is out of luck.
332
 *
333
 * We'll define LINKTYPE_PFSYNC as 18, *even on FreeBSD*, and map
334
 * it, so that savefiles won't use 121 for PFSYNC - they'll all
335
 * use 18.  Code that uses pcap_datalink() to determine the link-layer
336
 * header type of a savefile won't, when built and run on FreeBSD,
337
 * be able to distinguish between LINKTYPE_PFSYNC and LINKTYPE_HHDLC
338
 * capture files; code that doesn't, such as the code in Wireshark,
339
 * will be able to distinguish between them.
340
 */
341
#ifdef __FreeBSD__
342
#define DLT_PFSYNC                121
343
#else
344
#define DLT_HHDLC                121
345
#endif
346

    
347
/*
348
 * This is for RFC 2625 IP-over-Fibre Channel.
349
 *
350
 * This is not for use with raw Fibre Channel, where the link-layer
351
 * header starts with a Fibre Channel frame header; it's for IP-over-FC,
352
 * where the link-layer header starts with an RFC 2625 Network_Header
353
 * field.
354
 */
355
#define DLT_IP_OVER_FC                122
356

    
357
/*
358
 * This is for Full Frontal ATM on Solaris with SunATM, with a
359
 * pseudo-header followed by an AALn PDU.
360
 *
361
 * There may be other forms of Full Frontal ATM on other OSes,
362
 * with different pseudo-headers.
363
 *
364
 * If ATM software returns a pseudo-header with VPI/VCI information
365
 * (and, ideally, packet type information, e.g. signalling, ILMI,
366
 * LANE, LLC-multiplexed traffic, etc.), it should not use
367
 * DLT_ATM_RFC1483, but should get a new DLT_ value, so tcpdump
368
 * and the like don't have to infer the presence or absence of a
369
 * pseudo-header and the form of the pseudo-header.
370
 */
371
#define DLT_SUNATM                123        /* Solaris+SunATM */
372

    
373
/*
374
 * Reserved as per request from Kent Dahlgren <kent@praesum.com>
375
 * for private use.
376
 */
377
#define DLT_RIO                 124     /* RapidIO */
378
#define DLT_PCI_EXP             125     /* PCI Express */
379
#define DLT_AURORA              126     /* Xilinx Aurora link layer */
380

    
381
/*
382
 * Header for 802.11 plus a number of bits of link-layer information
383
 * including radio information, used by some recent BSD drivers as
384
 * well as the madwifi Atheros driver for Linux.
385
 */
386
#define DLT_IEEE802_11_RADIO        127        /* 802.11 plus radiotap radio header */
387

    
388
/*
389
 * Reserved for the TZSP encapsulation, as per request from
390
 * Chris Waters <chris.waters@networkchemistry.com>
391
 * TZSP is a generic encapsulation for any other link type,
392
 * which includes a means to include meta-information
393
 * with the packet, e.g. signal strength and channel
394
 * for 802.11 packets.
395
 */
396
#define DLT_TZSP                128     /* Tazmen Sniffer Protocol */
397

    
398
/*
399
 * BSD's ARCNET headers have the source host, destination host,
400
 * and type at the beginning of the packet; that's what's handed
401
 * up to userland via BPF.
402
 *
403
 * Linux's ARCNET headers, however, have a 2-byte offset field
404
 * between the host IDs and the type; that's what's handed up
405
 * to userland via PF_PACKET sockets.
406
 *
407
 * We therefore have to have separate DLT_ values for them.
408
 */
409
#define DLT_ARCNET_LINUX        129        /* ARCNET */
410

    
411
/*
412
 * Juniper-private data link types, as per request from
413
 * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
414
 * for passing on chassis-internal metainformation such as
415
 * QOS profiles, etc..
416
 */
417
#define DLT_JUNIPER_MLPPP       130
418
#define DLT_JUNIPER_MLFR        131
419
#define DLT_JUNIPER_ES          132
420
#define DLT_JUNIPER_GGSN        133
421
#define DLT_JUNIPER_MFR         134
422
#define DLT_JUNIPER_ATM2        135
423
#define DLT_JUNIPER_SERVICES    136
424
#define DLT_JUNIPER_ATM1        137
425

    
426
/*
427
 * Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund
428
 * <dieter@apple.com>.  The header that's presented is an Ethernet-like
429
 * header:
430
 *
431
 *        #define FIREWIRE_EUI64_LEN        8
432
 *        struct firewire_header {
433
 *                u_char  firewire_dhost[FIREWIRE_EUI64_LEN];
434
 *                u_char  firewire_shost[FIREWIRE_EUI64_LEN];
435
 *                u_short firewire_type;
436
 *        };
437
 *
438
 * with "firewire_type" being an Ethernet type value, rather than,
439
 * for example, raw GASP frames being handed up.
440
 */
441
#define DLT_APPLE_IP_OVER_IEEE1394        138
442

    
443
/*
444
 * Various SS7 encapsulations, as per a request from Jeff Morriss
445
 * <jeff.morriss[AT]ulticom.com> and subsequent discussions.
446
 */
447
#define DLT_MTP2_WITH_PHDR        139        /* pseudo-header with various info, followed by MTP2 */
448
#define DLT_MTP2                140        /* MTP2, without pseudo-header */
449
#define DLT_MTP3                141        /* MTP3, without pseudo-header or MTP2 */
450
#define DLT_SCCP                142        /* SCCP, without pseudo-header or MTP2 or MTP3 */
451

    
452
/*
453
 * DOCSIS MAC frames.
454
 */
455
#define DLT_DOCSIS                143
456

    
457
/*
458
 * Linux-IrDA packets. Protocol defined at http://www.irda.org.
459
 * Those packets include IrLAP headers and above (IrLMP...), but
460
 * don't include Phy framing (SOF/EOF/CRC & byte stuffing), because Phy
461
 * framing can be handled by the hardware and depend on the bitrate.
462
 * This is exactly the format you would get capturing on a Linux-IrDA
463
 * interface (irdaX), but not on a raw serial port.
464
 * Note the capture is done in "Linux-cooked" mode, so each packet include
465
 * a fake packet header (struct sll_header). This is because IrDA packet
466
 * decoding is dependant on the direction of the packet (incomming or
467
 * outgoing).
468
 * When/if other platform implement IrDA capture, we may revisit the
469
 * issue and define a real DLT_IRDA...
470
 * Jean II
471
 */
472
#define DLT_LINUX_IRDA                144
473

    
474
/*
475
 * Reserved for IBM SP switch and IBM Next Federation switch.
476
 */
477
#define DLT_IBM_SP                145
478
#define DLT_IBM_SN                146
479

    
480
/*
481
 * Reserved for private use.  If you have some link-layer header type
482
 * that you want to use within your organization, with the capture files
483
 * using that link-layer header type not ever be sent outside your
484
 * organization, you can use these values.
485
 *
486
 * No libpcap release will use these for any purpose, nor will any
487
 * tcpdump release use them, either.
488
 *
489
 * Do *NOT* use these in capture files that you expect anybody not using
490
 * your private versions of capture-file-reading tools to read; in
491
 * particular, do *NOT* use them in products, otherwise you may find that
492
 * people won't be able to use tcpdump, or snort, or Ethereal, or... to
493
 * read capture files from your firewall/intrusion detection/traffic
494
 * monitoring/etc. appliance, or whatever product uses that DLT_ value,
495
 * and you may also find that the developers of those applications will
496
 * not accept patches to let them read those files.
497
 *
498
 * Also, do not use them if somebody might send you a capture using them
499
 * for *their* private type and tools using them for *your* private type
500
 * would have to read them.
501
 *
502
 * Instead, ask "tcpdump-workers@lists.tcpdump.org" for a new DLT_ value,
503
 * as per the comment above, and use the type you're given.
504
 */
505
#define DLT_USER0                147
506
#define DLT_USER1                148
507
#define DLT_USER2                149
508
#define DLT_USER3                150
509
#define DLT_USER4                151
510
#define DLT_USER5                152
511
#define DLT_USER6                153
512
#define DLT_USER7                154
513
#define DLT_USER8                155
514
#define DLT_USER9                156
515
#define DLT_USER10                157
516
#define DLT_USER11                158
517
#define DLT_USER12                159
518
#define DLT_USER13                160
519
#define DLT_USER14                161
520
#define DLT_USER15                162
521

    
522
/*
523
 * For future use with 802.11 captures - defined by AbsoluteValue
524
 * Systems to store a number of bits of link-layer information
525
 * including radio information:
526
 *
527
 *        http://www.shaftnet.org/~pizza/software/capturefrm.txt
528
 *
529
 * but it might be used by some non-AVS drivers now or in the
530
 * future.
531
 */
532
#define DLT_IEEE802_11_RADIO_AVS 163        /* 802.11 plus AVS radio header */
533

    
534
/*
535
 * Juniper-private data link type, as per request from
536
 * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
537
 * for passing on chassis-internal metainformation such as
538
 * QOS profiles, etc..
539
 */
540
#define DLT_JUNIPER_MONITOR     164
541

    
542
/*
543
 * BACnet MS/TP frames.
544
 */
545
#define DLT_BACNET_MS_TP        165
546

    
547
/*
548
 * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>.
549
 *
550
 * This is used in some OSes to allow a kernel socket filter to distinguish
551
 * between incoming and outgoing packets, on a socket intended to
552
 * supply pppd with outgoing packets so it can do dial-on-demand and
553
 * hangup-on-lack-of-demand; incoming packets are filtered out so they
554
 * don't cause pppd to hold the connection up (you don't want random
555
 * input packets such as port scans, packets from old lost connections,
556
 * etc. to force the connection to stay up).
557
 *
558
 * The first byte of the PPP header (0xff03) is modified to accomodate
559
 * the direction - 0x00 = IN, 0x01 = OUT.
560
 */
561
#define DLT_PPP_PPPD                166
562

    
563
/*
564
 * Names for backwards compatibility with older versions of some PPP
565
 * software; new software should use DLT_PPP_PPPD.
566
 */
567
#define DLT_PPP_WITH_DIRECTION        DLT_PPP_PPPD
568
#define DLT_LINUX_PPP_WITHDIRECTION        DLT_PPP_PPPD
569

    
570
/*
571
 * Juniper-private data link type, as per request from
572
 * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
573
 * for passing on chassis-internal metainformation such as
574
 * QOS profiles, cookies, etc..
575
 */
576
#define DLT_JUNIPER_PPPOE       167
577
#define DLT_JUNIPER_PPPOE_ATM   168
578

    
579
#define DLT_GPRS_LLC                169        /* GPRS LLC */
580
#define DLT_GPF_T                170        /* GPF-T (ITU-T G.7041/Y.1303) */
581
#define DLT_GPF_F                171        /* GPF-F (ITU-T G.7041/Y.1303) */
582

    
583
/*
584
 * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line
585
 * monitoring equipment.
586
 */
587
#define DLT_GCOM_T1E1                172
588
#define DLT_GCOM_SERIAL                173
589

    
590
/*
591
 * Juniper-private data link type, as per request from
592
 * Hannes Gredler <hannes@juniper.net>.  The DLT_ is used
593
 * for internal communication to Physical Interface Cards (PIC)
594
 */
595
#define DLT_JUNIPER_PIC_PEER    174
596

    
597
/*
598
 * Link types requested by Gregor Maier <gregor@endace.com> of Endace
599
 * Measurement Systems.  They add an ERF header (see
600
 * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of
601
 * the link-layer header.
602
 */
603
#define DLT_ERF_ETH                175        /* Ethernet */
604
#define DLT_ERF_POS                176        /* Packet-over-SONET */
605

    
606
/*
607
 * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD
608
 * for vISDN (http://www.orlandi.com/visdn/).  Its link-layer header
609
 * includes additional information before the LAPD header, so it's
610
 * not necessarily a generic LAPD header.
611
 */
612
#define DLT_LINUX_LAPD                177
613

    
614
/*
615
 * Juniper-private data link type, as per request from
616
 * Hannes Gredler <hannes@juniper.net>.
617
 * The DLT_ are used for prepending meta-information
618
 * like interface index, interface name
619
 * before standard Ethernet, PPP, Frelay & C-HDLC Frames
620
 */
621
#define DLT_JUNIPER_ETHER       178
622
#define DLT_JUNIPER_PPP         179
623
#define DLT_JUNIPER_FRELAY      180
624
#define DLT_JUNIPER_CHDLC       181
625

    
626
/*
627
 * Multi Link Frame Relay (FRF.16)
628
 */
629
#define DLT_MFR                 182
630

    
631
/*
632
 * Juniper-private data link type, as per request from
633
 * Hannes Gredler <hannes@juniper.net>.
634
 * The DLT_ is used for internal communication with a
635
 * voice Adapter Card (PIC)
636
 */
637
#define DLT_JUNIPER_VP          183
638

    
639
/*
640
 * Arinc 429 frames.
641
 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
642
 * Every frame contains a 32bit A429 label.
643
 * More documentation on Arinc 429 can be found at
644
 * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
645
 */
646
#define DLT_A429                184
647

    
648
/*
649
 * Arinc 653 Interpartition Communication messages.
650
 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
651
 * Please refer to the A653-1 standard for more information.
652
 */
653
#define DLT_A653_ICM            185
654

    
655
/*
656
 * USB packets, beginning with a USB setup header; requested by
657
 * Paolo Abeni <paolo.abeni@email.it>.
658
 */
659
#define DLT_USB                        186
660

    
661
/*
662
 * Bluetooth HCI UART transport layer (part H:4); requested by
663
 * Paolo Abeni.
664
 */
665
#define DLT_BLUETOOTH_HCI_H4        187
666

    
667
/*
668
 * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
669
 * <cruz_petagay@bah.com>.
670
 */
671
#define DLT_IEEE802_16_MAC_CPS        188
672

    
673
/*
674
 * USB packets, beginning with a Linux USB header; requested by
675
 * Paolo Abeni <paolo.abeni@email.it>.
676
 */
677
#define DLT_USB_LINUX                189
678

    
679
/*
680
 * Controller Area Network (CAN) v. 2.0B packets.
681
 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
682
 * Used to dump CAN packets coming from a CAN Vector board.
683
 * More documentation on the CAN v2.0B frames can be found at
684
 * http://www.can-cia.org/downloads/?269
685
 */
686
#define DLT_CAN20B              190
687

    
688
/*
689
 * IEEE 802.15.4, with address fields padded, as is done by Linux
690
 * drivers; requested by Juergen Schimmer.
691
 */
692
#define DLT_IEEE802_15_4_LINUX        191
693

    
694
/*
695
 * Per Packet Information encapsulated packets.
696
 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
697
 */
698
#define DLT_PPI                        192
699

    
700
/*
701
 * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
702
 * requested by Charles Clancy.
703
 */
704
#define DLT_IEEE802_16_MAC_CPS_RADIO        193
705

    
706
/*
707
 * Juniper-private data link type, as per request from
708
 * Hannes Gredler <hannes@juniper.net>.
709
 * The DLT_ is used for internal communication with a
710
 * integrated service module (ISM).
711
 */
712
#define DLT_JUNIPER_ISM         194
713

    
714
/*
715
 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
716
 * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.
717
 * For this one, we expect the FCS to be present at the end of the frame;
718
 * if the frame has no FCS, DLT_IEEE802_15_4_NOFCS should be used.
719
 */
720
#define DLT_IEEE802_15_4        195
721

    
722
/*
723
 * Various link-layer types, with a pseudo-header, for SITA
724
 * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).
725
 */
726
#define DLT_SITA                196
727

    
728
/*
729
 * Various link-layer types, with a pseudo-header, for Endace DAG cards;
730
 * encapsulates Endace ERF records.  Requested by Stephen Donnelly
731
 * <stephen@endace.com>.
732
 */
733
#define DLT_ERF                        197
734

    
735
/*
736
 * Special header prepended to Ethernet packets when capturing from a
737
 * u10 Networks board.  Requested by Phil Mulholland
738
 * <phil@u10networks.com>.
739
 */
740
#define DLT_RAIF1                198
741

    
742
/*
743
 * IPMB packet for IPMI, beginning with the I2C slave address, followed
744
 * by the netFn and LUN, etc..  Requested by Chanthy Toeung
745
 * <chanthy.toeung@ca.kontron.com>.
746
 */
747
#define DLT_IPMB                199
748

    
749
/*
750
 * Juniper-private data link type, as per request from
751
 * Hannes Gredler <hannes@juniper.net>.
752
 * The DLT_ is used for capturing data on a secure tunnel interface.
753
 */
754
#define DLT_JUNIPER_ST          200
755

    
756
/*
757
 * Bluetooth HCI UART transport layer (part H:4), with pseudo-header
758
 * that includes direction information; requested by Paolo Abeni.
759
 */
760
#define DLT_BLUETOOTH_HCI_H4_WITH_PHDR        201
761

    
762
/*
763
 * AX.25 packet with a 1-byte KISS header; see
764
 *
765
 *        http://www.ax25.net/kiss.htm
766
 *
767
 * as per Richard Stearn <richard@rns-stearn.demon.co.uk>.
768
 */
769
#define DLT_AX25_KISS                202
770

    
771
/*
772
 * LAPD packets from an ISDN channel, starting with the address field,
773
 * with no pseudo-header.
774
 * Requested by Varuna De Silva <varunax@gmail.com>.
775
 */
776
#define DLT_LAPD                203
777

    
778
/*
779
 * Variants of various link-layer headers, with a one-byte direction
780
 * pseudo-header prepended - zero means "received by this host",
781
 * non-zero (any non-zero value) means "sent by this host" - as per
782
 * Will Barker <w.barker@zen.co.uk>.
783
 */
784
#define DLT_PPP_WITH_DIR        204        /* PPP - don't confuse with DLT_PPP_WITH_DIRECTION */
785
#define DLT_C_HDLC_WITH_DIR        205        /* Cisco HDLC */
786
#define DLT_FRELAY_WITH_DIR        206        /* Frame Relay */
787
#define DLT_LAPB_WITH_DIR        207        /* LAPB */
788

    
789
/*
790
 * 208 is reserved for an as-yet-unspecified proprietary link-layer
791
 * type, as requested by Will Barker.
792
 */
793

    
794
/*
795
 * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman
796
 * <avn@pigeonpoint.com>.
797
 */
798
#define DLT_IPMB_LINUX                209
799

    
800
/*
801
 * FlexRay automotive bus - http://www.flexray.com/ - as requested
802
 * by Hannes Kaelber <hannes.kaelber@x2e.de>.
803
 */
804
#define DLT_FLEXRAY                210
805

    
806
/*
807
 * Media Oriented Systems Transport (MOST) bus for multimedia
808
 * transport - http://www.mostcooperation.com/ - as requested
809
 * by Hannes Kaelber <hannes.kaelber@x2e.de>.
810
 */
811
#define DLT_MOST                211
812

    
813
/*
814
 * Local Interconnect Network (LIN) bus for vehicle networks -
815
 * http://www.lin-subbus.org/ - as requested by Hannes Kaelber
816
 * <hannes.kaelber@x2e.de>.
817
 */
818
#define DLT_LIN                        212
819

    
820
/*
821
 * X2E-private data link type used for serial line capture,
822
 * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
823
 */
824
#define DLT_X2E_SERIAL                213
825

    
826
/*
827
 * X2E-private data link type used for the Xoraya data logger
828
 * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
829
 */
830
#define DLT_X2E_XORAYA                214
831

    
832
/*
833
 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
834
 * nothing), but with the PHY-level data for non-ASK PHYs (4 octets
835
 * of 0 as preamble, one octet of SFD, one octet of frame length+
836
 * reserved bit, and then the MAC-layer data, starting with the
837
 * frame control field).
838
 *
839
 * Requested by Max Filippov <jcmvbkbc@gmail.com>.
840
 */
841
#define DLT_IEEE802_15_4_NONASK_PHY        215
842

    
843
/*
844
 * David Gibson <david@gibson.dropbear.id.au> requested this for
845
 * captures from the Linux kernel /dev/input/eventN devices. This
846
 * is used to communicate keystrokes and mouse movements from the
847
 * Linux kernel to display systems, such as Xorg.
848
 */
849
#define DLT_LINUX_EVDEV                216
850

    
851
/*
852
 * GSM Um and Abis interfaces, preceded by a "gsmtap" header.
853
 *
854
 * Requested by Harald Welte <laforge@gnumonks.org>.
855
 */
856
#define DLT_GSMTAP_UM                217
857
#define DLT_GSMTAP_ABIS                218
858

    
859
/*
860
 * MPLS, with an MPLS label as the link-layer header.
861
 * Requested by Michele Marchetto <michele@openbsd.org> on behalf
862
 * of OpenBSD.
863
 */
864
#define DLT_MPLS                219
865

    
866
/*
867
 * USB packets, beginning with a Linux USB header, with the USB header
868
 * padded to 64 bytes; required for memory-mapped access.
869
 */
870
#define DLT_USB_LINUX_MMAPPED        220
871

    
872
/*
873
 * DECT packets, with a pseudo-header; requested by
874
 * Matthias Wenzel <tcpdump@mazzoo.de>.
875
 */
876
#define DLT_DECT                221
877

    
878
/*
879
 * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov>
880
 * Date: Mon, 11 May 2009 11:18:30 -0500
881
 *
882
 * DLT_AOS. We need it for AOS Space Data Link Protocol.
883
 *   I have already written dissectors for but need an OK from
884
 *   legal before I can submit a patch.
885
 *
886
 */
887
#define DLT_AOS                 222
888

    
889
/*
890
 * Wireless HART (Highway Addressable Remote Transducer)
891
 * From the HART Communication Foundation
892
 * IES/PAS 62591
893
 *
894
 * Requested by Sam Roberts <vieuxtech@gmail.com>.
895
 */
896
#define DLT_WIHART                223
897

    
898
/*
899
 * Fibre Channel FC-2 frames, beginning with a Frame_Header.
900
 * Requested by Kahou Lei <kahou82@gmail.com>.
901
 */
902
#define DLT_FC_2                224
903

    
904
/*
905
 * Fibre Channel FC-2 frames, beginning with an encoding of the
906
 * SOF, and ending with an encoding of the EOF.
907
 *
908
 * The encodings represent the frame delimiters as 4-byte sequences
909
 * representing the corresponding ordered sets, with K28.5
910
 * represented as 0xBC, and the D symbols as the corresponding
911
 * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2,
912
 * is represented as 0xBC 0xB5 0x55 0x55.
913
 *
914
 * Requested by Kahou Lei <kahou82@gmail.com>.
915
 */
916
#define DLT_FC_2_WITH_FRAME_DELIMS        225
917

    
918
/*
919
 * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>.
920
 *
921
 * The pseudo-header starts with a one-byte version number; for version 2,
922
 * the pseudo-header is:
923
 *
924
 * struct dl_ipnetinfo {
925
 *     u_int8_t   dli_version;
926
 *     u_int8_t   dli_family;
927
 *     u_int16_t  dli_htype;
928
 *     u_int32_t  dli_pktlen;
929
 *     u_int32_t  dli_ifindex;
930
 *     u_int32_t  dli_grifindex;
931
 *     u_int32_t  dli_zsrc;
932
 *     u_int32_t  dli_zdst;
933
 * };
934
 *
935
 * dli_version is 2 for the current version of the pseudo-header.
936
 *
937
 * dli_family is a Solaris address family value, so it's 2 for IPv4
938
 * and 26 for IPv6.
939
 *
940
 * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing
941
 * packets, and 2 for packets arriving from another zone on the same
942
 * machine.
943
 *
944
 * dli_pktlen is the length of the packet data following the pseudo-header
945
 * (so the captured length minus dli_pktlen is the length of the
946
 * pseudo-header, assuming the entire pseudo-header was captured).
947
 *
948
 * dli_ifindex is the interface index of the interface on which the
949
 * packet arrived.
950
 *
951
 * dli_grifindex is the group interface index number (for IPMP interfaces).
952
 *
953
 * dli_zsrc is the zone identifier for the source of the packet.
954
 *
955
 * dli_zdst is the zone identifier for the destination of the packet.
956
 *
957
 * A zone number of 0 is the global zone; a zone number of 0xffffffff
958
 * means that the packet arrived from another host on the network, not
959
 * from another zone on the same machine.
960
 *
961
 * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates
962
 * which of those it is.
963
 */
964
#define DLT_IPNET                226
965

    
966
/*
967
 * CAN (Controller Area Network) frames, with a pseudo-header as supplied
968
 * by Linux SocketCAN.  See Documentation/networking/can.txt in the Linux
969
 * source.
970
 *
971
 * Requested by Felix Obenhuber <felix@obenhuber.de>.
972
 */
973
#define DLT_CAN_SOCKETCAN        227
974

    
975
/*
976
 * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies
977
 * whether it's v4 or v6.  Requested by Darren Reed <Darren.Reed@Sun.COM>.
978
 */
979
#define DLT_IPV4                228
980
#define DLT_IPV6                229
981

    
982
/*
983
 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
984
 * nothing), and with no FCS at the end of the frame; requested by
985
 * Jon Smirl <jonsmirl@gmail.com>.
986
 */
987
#define DLT_IEEE802_15_4_NOFCS        230
988

    
989
/*
990
 * Raw D-Bus:
991
 *
992
 *        http://www.freedesktop.org/wiki/Software/dbus
993
 *
994
 * messages:
995
 *
996
 *        http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages
997
 *
998
 * starting with the endianness flag, followed by the message type, etc.,
999
 * but without the authentication handshake before the message sequence:
1000
 *
1001
 *        http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol
1002
 *
1003
 * Requested by Martin Vidner <martin@vidner.net>.
1004
 */
1005
#define DLT_DBUS                231
1006

    
1007
/*
1008
 * Juniper-private data link type, as per request from
1009
 * Hannes Gredler <hannes@juniper.net>.
1010
 */
1011
#define DLT_JUNIPER_VS                        232
1012
#define DLT_JUNIPER_SRX_E2E                233
1013
#define DLT_JUNIPER_FIBRECHANNEL        234
1014

    
1015
/*
1016
 * DVB-CI (DVB Common Interface for communication between a PC Card
1017
 * module and a DVB receiver).  See
1018
 *
1019
 *        http://www.kaiser.cx/pcap-dvbci.html
1020
 *
1021
 * for the specification.
1022
 *
1023
 * Requested by Martin Kaiser <martin@kaiser.cx>.
1024
 */
1025
#define DLT_DVB_CI                235
1026

    
1027
/*
1028
 * Variant of 3GPP TS 27.010 multiplexing protocol (similar to, but
1029
 * *not* the same as, 27.010).  Requested by Hans-Christoph Schemmel
1030
 * <hans-christoph.schemmel@cinterion.com>.
1031
 */
1032
#define DLT_MUX27010                236
1033

    
1034
/*
1035
 * STANAG 5066 D_PDUs.  Requested by M. Baris Demiray
1036
 * <barisdemiray@gmail.com>.
1037
 */
1038
#define DLT_STANAG_5066_D_PDU        237
1039

    
1040
/*
1041
 * Juniper-private data link type, as per request from
1042
 * Hannes Gredler <hannes@juniper.net>.
1043
 */
1044
#define DLT_JUNIPER_ATM_CEMIC        238
1045

    
1046
/*
1047
 * NetFilter LOG messages
1048
 * (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets)
1049
 *
1050
 * Requested by Jakub Zawadzki <darkjames-ws@darkjames.pl>
1051
 */
1052
#define DLT_NFLOG                239
1053

    
1054
/*
1055
 * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
1056
 * for Ethernet packets with a 4-byte pseudo-header and always
1057
 * with the payload including the FCS, as supplied by their
1058
 * netANALYZER hardware and software.
1059
 *
1060
 * Requested by Holger P. Frommer <HPfrommer@hilscher.com>
1061
 */
1062
#define DLT_NETANALYZER                240
1063

    
1064
/*
1065
 * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
1066
 * for Ethernet packets with a 4-byte pseudo-header and FCS and
1067
 * with the Ethernet header preceded by 7 bytes of preamble and
1068
 * 1 byte of SFD, as supplied by their netANALYZER hardware and
1069
 * software.
1070
 *
1071
 * Requested by Holger P. Frommer <HPfrommer@hilscher.com>
1072
 */
1073
#define DLT_NETANALYZER_TRANSPARENT        241
1074

    
1075
/*
1076
 * IP-over-Infiniband, as specified by RFC 4391.
1077
 *
1078
 * Requested by Petr Sumbera <petr.sumbera@oracle.com>.
1079
 */
1080
#define DLT_IPOIB                242
1081

    
1082
/*
1083
 * MPEG-2 transport stream (ISO 13818-1/ITU-T H.222.0).
1084
 *
1085
 * Requested by Guy Martin <gmsoft@tuxicoman.be>.
1086
 */
1087
#define DLT_MPEG_2_TS                243
1088

    
1089
/*
1090
 * ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as
1091
 * used by their ng40 protocol tester.
1092
 *
1093
 * Requested by Jens Grimmer <jens.grimmer@ng4t.com>.
1094
 */
1095
#define DLT_NG40                244
1096

    
1097
/*
1098
 * Pseudo-header giving adapter number and flags, followed by an NFC
1099
 * (Near-Field Communications) Logical Link Control Protocol (LLCP) PDU,
1100
 * as specified by NFC Forum Logical Link Control Protocol Technical
1101
 * Specification LLCP 1.1.
1102
 *
1103
 * Requested by Mike Wakerly <mikey@google.com>.
1104
 */
1105
#define DLT_NFC_LLCP                245
1106

    
1107
/*
1108
 * 245 is used as LINKTYPE_PFSYNC; do not use it for any other purpose.
1109
 *
1110
 * DLT_PFSYNC has different values on different platforms, and all of
1111
 * them collide with something used elsewhere.  On platforms that
1112
 * don't already define it, define it as 245.
1113
 */
1114
#if !defined(__FreeBSD__) && !defined(__OpenBSD__) && !defined(__NetBSD__) && !defined(__DragonFly__) && !defined(__APPLE__)
1115
#define DLT_PFSYNC                246
1116
#endif
1117

    
1118

    
1119
/*
1120
 * Raw InfiniBand packets, starting with the Local Routing Header.
1121
 *
1122
 * Requested by Oren Kladnitsky <orenk@mellanox.com>.
1123
 */
1124
#define DLT_INFINIBAND                247
1125

    
1126
/*
1127
 * SCTP, with no lower-level protocols (i.e., no IPv4 or IPv6).
1128
 *
1129
 * Requested by Michael Tuexen <Michael.Tuexen@lurchi.franken.de>.
1130
 */
1131
#define DLT_SCTP                248
1132

    
1133
/*
1134
 * USB packets, beginning with a USBPcap header.
1135
 *
1136
 * Requested by Tomasz Mon <desowin@gmail.com>
1137
 */
1138
#define DLT_USBPCAP                249
1139

    
1140
/*
1141
 * Schweitzer Engineering Laboratories "RTAC" product serial-line
1142
 * packets.
1143
 *
1144
 * Requested by Chris Bontje <chris_bontje@selinc.com>.
1145
 */
1146
#define DLT_RTAC_SERIAL                250
1147

    
1148
/*
1149
 * Bluetooth Low Energy air interface link-layer packets.
1150
 *
1151
 * Requested by Mike Kershaw <dragorn@kismetwireless.net>.
1152
 */
1153
#define DLT_BLUETOOTH_LE_LL        251
1154

    
1155
/*
1156
 * DLT type for upper-protocol layer PDU saves from wireshark.
1157
 * 
1158
 * the actual contents are determined by two TAGs stored with each
1159
 * packet:
1160
 *   EXP_PDU_TAG_LINKTYPE          the link type (LINKTYPE_ value) of the
1161
 *                                   original packet.
1162
 *
1163
 *   EXP_PDU_TAG_PROTO_NAME        the name of the wireshark dissector
1164
 *                                    that can make sense of the data stored.
1165
 */
1166
#define DLT_WIRESHARK_UPPER_PDU        252
1167

    
1168
/*
1169
 * DLT type for the netlink protocol (nlmon devices).
1170
 */
1171
#define DLT_NETLINK                253
1172

    
1173
/*
1174
 * Bluetooth Linux Monitor headers for the BlueZ stack.
1175
 */
1176
#define DLT_BLUETOOTH_LINUX_MONITOR        254
1177

    
1178
/*
1179
 * Bluetooth Basic Rate/Enhanced Data Rate baseband packets, as
1180
 * captured by Ubertooth.
1181
 */
1182
#define DLT_BLUETOOTH_BREDR_BB        255
1183

    
1184
/*
1185
 * Bluetooth Low Energy link layer packets, as captured by Ubertooth.
1186
 */
1187
#define DLT_BLUETOOTH_LE_LL_WITH_PHDR        256
1188

    
1189
/*
1190
 * PROFIBUS data link layer.
1191
 */
1192
#define DLT_PROFIBUS_DL                257
1193

    
1194
/*
1195
 * Apple's DLT_PKTAP headers.
1196
 *
1197
 * Sadly, the folks at Apple either had no clue that the DLT_USERn values
1198
 * are for internal use within an organization and partners only, and
1199
 * didn't know that the right way to get a link-layer header type is to
1200
 * ask tcpdump.org for one, or knew and didn't care, so they just
1201
 * used DLT_USER2, which causes problems for everything except for
1202
 * their version of tcpdump.
1203
 *
1204
 * So I'll just give them one; hopefully this will show up in a
1205
 * libpcap release in time for them to get this into 10.10 Big Sur
1206
 * or whatever Mavericks' successor is called.  LINKTYPE_PKTAP
1207
 * will be 258 *even on OS X*; that is *intentional*, so that
1208
 * PKTAP files look the same on *all* OSes (different OSes can have
1209
 * different numerical values for a given DLT_, but *MUST NOT* have
1210
 * different values for what goes in a file, as files can be moved
1211
 * between OSes!).
1212
 *
1213
 * When capturing, on a system with a Darwin-based OS, on a device
1214
 * that returns 149 (DLT_USER2 and Apple's DLT_PKTAP) with this
1215
 * version of libpcap, the DLT_ value for the pcap_t  will be DLT_PKTAP,
1216
 * and that will continue to be DLT_USER2 on Darwin-based OSes. That way,
1217
 * binary compatibility with Mavericks is preserved for programs using
1218
 * this version of libpcap.  This does mean that if you were using
1219
 * DLT_USER2 for some capture device on OS X, you can't do so with
1220
 * this version of libpcap, just as you can't with Apple's libpcap -
1221
 * on OS X, they define DLT_PKTAP to be DLT_USER2, so programs won't
1222
 * be able to distinguish between PKTAP and whatever you were using
1223
 * DLT_USER2 for.
1224
 *
1225
 * If the program saves the capture to a file using this version of
1226
 * libpcap's pcap_dump code, the LINKTYPE_ value in the file will be
1227
 * LINKTYPE_PKTAP, which will be 258, even on Darwin-based OSes.
1228
 * That way, the file will *not* be a DLT_USER2 file.  That means
1229
 * that the latest version of tcpdump, when built with this version
1230
 * of libpcap, and sufficiently recent versions of Wireshark will
1231
 * be able to read those files and interpret them correctly; however,
1232
 * Apple's version of tcpdump in OS X 10.9 won't be able to handle
1233
 * them.  (Hopefully, Apple will pick up this version of libpcap,
1234
 * and the corresponding version of tcpdump, so that tcpdump will
1235
 * be able to handle the old LINKTYPE_USER2 captures *and* the new
1236
 * LINKTYPE_PKTAP captures.)
1237
 */
1238
#ifdef __APPLE__
1239
#define DLT_PKTAP        DLT_USER2
1240
#else
1241
#define DLT_PKTAP        258
1242
#endif
1243

    
1244
/*
1245
 * Ethernet packets preceded by a header giving the last 6 octets
1246
 * of the preamble specified by 802.3-2012 Clause 65, section
1247
 * 65.1.3.2 "Transmit".
1248
 */
1249
#define DLT_EPON        259
1250

    
1251
/*
1252
 * IPMI trace packets, as specified by Table 3-20 "Trace Data Block Format"
1253
 * in the PICMG HPM.2 specification.
1254
 */
1255
#define DLT_IPMI_HPM_2        260
1256

    
1257
/*
1258
 * per  Joshua Wright <jwright@hasborg.com>, formats for Zwave captures.
1259
 */
1260
#define DLT_ZWAVE_R1_R2  261
1261
#define DLT_ZWAVE_R3     262
1262

    
1263
/*
1264
 * per Steve Karg <skarg@users.sourceforge.net>, formats for Wattstopper
1265
 * Digital Lighting Management room bus serial protocol captures.
1266
 */
1267
#define DLT_WATTSTOPPER_DLM     263
1268

    
1269
#define DLT_MATCHING_MAX        263        /* highest value in the "matching" range */
1270

    
1271
/*
1272
 * DLT and savefile link type values are split into a class and
1273
 * a member of that class.  A class value of 0 indicates a regular
1274
 * DLT_/LINKTYPE_ value.
1275
 */
1276
#define DLT_CLASS(x)                ((x) & 0x03ff0000)
1277

    
1278
/*
1279
 * NetBSD-specific generic "raw" link type.  The class value indicates
1280
 * that this is the generic raw type, and the lower 16 bits are the
1281
 * address family we're dealing with.  Those values are NetBSD-specific;
1282
 * do not assume that they correspond to AF_ values for your operating
1283
 * system.
1284
 */
1285
#define        DLT_CLASS_NETBSD_RAWAF        0x02240000
1286
#define        DLT_NETBSD_RAWAF(af)        (DLT_CLASS_NETBSD_RAWAF | (af))
1287
#define        DLT_NETBSD_RAWAF_AF(x)        ((x) & 0x0000ffff)
1288
#define        DLT_IS_NETBSD_RAWAF(x)        (DLT_CLASS(x) == DLT_CLASS_NETBSD_RAWAF)
1289

    
1290
#endif /* !_NET_DLT_H_ */