The RA field is absent from management frames (addr1 is DA there), and
addr1 in other frames.
The TA field is absent from management frames (addr2 is SA there), and
addr2, if present, in other frames.
While we're at it, fix a font glitch in the pcap-filter man page.
don't know the netmask. (It also lets you test, at compile time,
whether you can rely on "ip broadcast" failing to compile when you pass
0xffffffff to pcap_compile().)
(255.255.255.255) be an indication that the netmask is unknown, and
return an error. Document that as the way to tell pcap_compile() that
the netmask is unknown. Have filtertest default to that as the netmask,
and add a -m flag to let you specify the netmask.
build 125 and later to use the native BPF with both IPNET and traditional
MAC (ethernet, etc) packet sniffing, the attached patches are required.
The attached patches represent what's in our internal build tree for libpcap.
structure we got back from getaddrinfo().
Plug some other getaddrinfo() leaks while we're at it.
Fail if you try to use "gateway" on ATM if we're not checking for ATM
LANE.
Update CREDITS to give Jon Smirl credit for some of the USB fixes.
Rename DLT_USB_LINUX_MMAP to DLT_USB_LINUX_MMAPPED, and declare a
structure for the header of packets in DLT_USB_LINUX_MMAPPED captures.
try scanning the sysfs USB directory first and, if that
directory doesn't exist, try the procfs USB directory, to handle
newer kernels where the relevant director is in sysfs;
use the data length, not the URB length, as the amount of data
in the packet (the URB length is the amount of space *available*
for the data, not the actual amount of data).
For the memory-mapped interface, include the padding after the URB and
setup header in the packet lengths, and return a different link-layer
type so that code reading the packets knows that padding is there.
always 144 bytes long. However, some drivers on Linux use
ARPHRD_IEEE80211_PRISM, but sometimes or always supply an AVS header, so
we have to check whether the radio header is a Prism header or an AVS
header, so, in practice, it's variable-length.
Treat DLT_PRISM_HEADER as having a variable-length header, and generate
code to find the length of the Prism header that first checks for an AVS
header and, if we have an AVS header, gets the length from the header,
and otherwise just gets a length of 144. This fixes Sourceforge bug
1847574.
Sort various references to the radio headers (case labels, functions,
etc.) into the same order (Prism, AVS, radiotap), for consistency. Put
PPI after them all.
Handle 802.11 and 802.11-plus-radio-header with a common case when
initializing.
payload, the existing value of that offset is *not* in the X register -
the offset of the MAC header is in the X register. Load the register
containing the offset of the MAC payload, add 2 to it, and store the
result back in that register.
802.11 headers - we only handle the QoS bit and fields, for now.
Clean up various other things either in the process of doing that or as
a requirement for doing that.
before compiling an expression; pcap_compile() can be called more than
once, and some registers can now be allocated and not freed in the
process of code generation (for example, the register allocated to hold
the length of a radiotap header, which can't be freed until we're
finished generating all the code).
Add support for additional link types to gencode.c, so we at least
support "link[N:M]" and an empty expression.
Sort the DLT_CHOICE values in order by the DLT_ value, add missing ones,
and fix some existing descriptions.
if it does, use that for the pf definitions;
if it doesn't, don't compile in pf support;
as both OpenBSD and FreeBSD have changed the pf definitions and header
format without changing the DLT value, so you can't reliably read
pflog-format libpcap files on a machine running an OS version other than
the one on which the file was generated.
This patch introduces support for the DAG ERF type
TYPE_COLOR_MC_HDLC_POS.
The patch also allows appropriate DAG cards (DAG 3.7T, DAG 7.1S)
to optionally produce DLT_MTP2_WITH_PHDR (139) traces when
capturing from channelised HDLC links, as an alternative to
DLT_MTP2 (140). When using the new DLT, the 'DAG channel' is
recorded in the pcap record pseudo header as the 'link_number'.
Basic BPF filtering support for DLT_MTP2_WITH_PHDR is also
added.
Fix some warnings.
several files:
date: 2006/02/27 15:53:24; author: drochner; state: Exp;
avoid shadowing globals, for WARNS=2
date: 2006/02/27 15:55:30; author: drochner; state: Exp;
minor constification, good for WARNS=3 now
date: 2006/02/27 15:57:17; author: drochner; state: Exp;
NetBSD adaption:
...
-const pcap_strerror() for consistency
gencode.c:
date: 2006/04/26 09:24:33; author: tron; state: Exp;
Add missing "const" keywords to match declarations in "pcap.h".
date: 2006/10/15 19:27:21; author: christos; state: Exp;
add a volatile variable to prevent vfork/longjmp clobbering.
optimize.c:
date: 2006/05/17 17:48:36; author: drochner; state: Exp;
Make the optimizer use unsigned numbers as the kernel does.
While it is not agreed on that purely unsigned arithmetics is nice,
different behaviour of optimized and unoptimized code is less desirable.
pcap-bpf.c:
date: 2006/02/27 15:51:38; author: drochner; state: Exp;
pull in from NetBSD's libpcap: use cloning bpf device on NetBSD
Have the configure script check for paths.h, so that we can include it
only if we have it, and use the cloning BPF device only if we're on
NetBSD *and* _PATH_BPF is defined (hopefully this will keep us from
using it on versions of NetBSD that don't have a cloning BPF device; if,
in the future, other OSes with BPF get cloning BPF devices, we can make
this work for them as well).
network-layer protocol is IPv4 or IPv6, regardless of the link-layer
protocol. Therefore, we have to check for IPv4 and IPv6, even for
DLT_RAW - do so by checking the version field in the header.
types. Modified to add ieee80211.h from FreeBSD, rather than depending
on the OS supplying the header, and to support all 802.11 radio header
types.
Clean up some link-layer type checks and the messages for failing those
checks.