The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net/dlt.h

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
    3  *      The Regents of the University of California.  All rights reserved.
    4  *
    5  * This code is derived from the Stanford/CMU enet packet filter,
    6  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
    7  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
    8  * Berkeley Laboratory.
    9  *
   10  * Redistribution and use in source and binary forms, with or without
   11  * modification, are permitted provided that the following conditions
   12  * are met:
   13  * 1. Redistributions of source code must retain the above copyright
   14  *    notice, this list of conditions and the following disclaimer.
   15  * 2. Redistributions in binary form must reproduce the above copyright
   16  *    notice, this list of conditions and the following disclaimer in the
   17  *    documentation and/or other materials provided with the distribution.
   18  * 3. Neither the name of the University nor the names of its contributors
   19  *    may be used to endorse or promote products derived from this software
   20  *    without specific prior written permission.
   21  *
   22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
   23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
   26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   32  * SUCH DAMAGE.
   33  *
   34  *      @(#)bpf.h       7.1 (Berkeley) 5/7/91
   35  *
   36  * $FreeBSD$
   37  */
   38 
   39 #ifndef _NET_DLT_H_
   40 #define _NET_DLT_H_
   41 
   42 /*
   43  * Link-layer header type codes.
   44  *
   45  * Do *NOT* add new values to this list without asking
   46  * "tcpdump-workers@lists.tcpdump.org" for a value.  Otherwise, you run
   47  * the risk of using a value that's already being used for some other
   48  * purpose, and of having tools that read libpcap-format captures not
   49  * being able to handle captures with your new DLT_ value, with no hope
   50  * that they will ever be changed to do so (as that would destroy their
   51  * ability to read captures using that value for that other purpose).
   52  *
   53  * See
   54  *
   55  *      http://www.tcpdump.org/linktypes.html
   56  *
   57  * for detailed descriptions of some of these link-layer header types.
   58  */
   59 
   60 /*
   61  * These are the types that are the same on all platforms, and that
   62  * have been defined by <net/bpf.h> for ages.
   63  */
   64 #define DLT_NULL        0       /* BSD loopback encapsulation */
   65 #define DLT_EN10MB      1       /* Ethernet (10Mb) */
   66 #define DLT_EN3MB       2       /* Experimental Ethernet (3Mb) */
   67 #define DLT_AX25        3       /* Amateur Radio AX.25 */
   68 #define DLT_PRONET      4       /* Proteon ProNET Token Ring */
   69 #define DLT_CHAOS       5       /* Chaos */
   70 #define DLT_IEEE802     6       /* 802.5 Token Ring */
   71 #define DLT_ARCNET      7       /* ARCNET, with BSD-style header */
   72 #define DLT_SLIP        8       /* Serial Line IP */
   73 #define DLT_PPP         9       /* Point-to-point Protocol */
   74 #define DLT_FDDI        10      /* FDDI */
   75 
   76 /*
   77  * These are types that are different on some platforms, and that
   78  * have been defined by <net/bpf.h> for ages.  We use #ifdefs to
   79  * detect the BSDs that define them differently from the traditional
   80  * libpcap <net/bpf.h>
   81  *
   82  * XXX - DLT_ATM_RFC1483 is 13 in BSD/OS, and DLT_RAW is 14 in BSD/OS,
   83  * but I don't know what the right #define is for BSD/OS.
   84  */
   85 #define DLT_ATM_RFC1483 11      /* LLC-encapsulated ATM */
   86 
   87 #ifdef __OpenBSD__
   88 #define DLT_RAW         14      /* raw IP */
   89 #else
   90 #define DLT_RAW         12      /* raw IP */
   91 #endif
   92 
   93 /*
   94  * Given that the only OS that currently generates BSD/OS SLIP or PPP
   95  * is, well, BSD/OS, arguably everybody should have chosen its values
   96  * for DLT_SLIP_BSDOS and DLT_PPP_BSDOS, which are 15 and 16, but they
   97  * didn't.  So it goes.
   98  */
   99 #if defined(__NetBSD__) || defined(__FreeBSD__)
  100 #ifndef DLT_SLIP_BSDOS
  101 #define DLT_SLIP_BSDOS  13      /* BSD/OS Serial Line IP */
  102 #define DLT_PPP_BSDOS   14      /* BSD/OS Point-to-point Protocol */
  103 #endif
  104 #else
  105 #define DLT_SLIP_BSDOS  15      /* BSD/OS Serial Line IP */
  106 #define DLT_PPP_BSDOS   16      /* BSD/OS Point-to-point Protocol */
  107 #endif
  108 
  109 /*
  110  * 17 was used for DLT_PFLOG in OpenBSD; it no longer is.
  111  *
  112  * It was DLT_LANE8023 in SuSE 6.3, so we defined LINKTYPE_PFLOG
  113  * as 117 so that pflog captures would use a link-layer header type
  114  * value that didn't collide with any other values.  On all
  115  * platforms other than OpenBSD, we defined DLT_PFLOG as 117,
  116  * and we mapped between LINKTYPE_PFLOG and DLT_PFLOG.
  117  *
  118  * OpenBSD eventually switched to using 117 for DLT_PFLOG as well.
  119  *
  120  * Don't use 17 for anything else.
  121  */
  122 
  123 /*
  124  * 18 is used for DLT_PFSYNC in OpenBSD, NetBSD, DragonFly BSD and
  125  * macOS; don't use it for anything else.  (FreeBSD uses 121, which
  126  * collides with DLT_HHDLC, even though it doesn't use 18 for
  127  * anything and doesn't appear to have ever used it for anything.)
  128  *
  129  * We define it as 18 on those platforms; it is, unfortunately, used
  130  * for DLT_CIP in Suse 6.3, so we don't define it as DLT_PFSYNC
  131  * in general.  As the packet format for it, like that for
  132  * DLT_PFLOG, is not only OS-dependent but OS-version-dependent,
  133  * we don't support printing it in tcpdump except on OSes that
  134  * have the relevant header files, so it's not that useful on
  135  * other platforms.
  136  */
  137 #if defined(__OpenBSD__) || defined(__NetBSD__) || defined(__DragonFly__) || defined(__APPLE__)
  138 #define DLT_PFSYNC      18
  139 #endif
  140 
  141 #define DLT_ATM_CLIP    19      /* Linux Classical-IP over ATM */
  142 
  143 /*
  144  * Apparently Redback uses this for its SmartEdge 400/800.  I hope
  145  * nobody else decided to use it, too.
  146  */
  147 #define DLT_REDBACK_SMARTEDGE   32
  148 
  149 /*
  150  * These values are defined by NetBSD; other platforms should refrain from
  151  * using them for other purposes, so that NetBSD savefiles with link
  152  * types of 50 or 51 can be read as this type on all platforms.
  153  */
  154 #define DLT_PPP_SERIAL  50      /* PPP over serial with HDLC encapsulation */
  155 #define DLT_PPP_ETHER   51      /* PPP over Ethernet */
  156 
  157 /*
  158  * The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses
  159  * a link-layer type of 99 for the tcpdump it supplies.  The link-layer
  160  * header has 6 bytes of unknown data, something that appears to be an
  161  * Ethernet type, and 36 bytes that appear to be 0 in at least one capture
  162  * I've seen.
  163  */
  164 #define DLT_SYMANTEC_FIREWALL   99
  165 
  166 /*
  167  * Values between 100 and 103 are used in capture file headers as
  168  * link-layer header type LINKTYPE_ values corresponding to DLT_ types
  169  * that differ between platforms; don't use those values for new DLT_
  170  * new types.
  171  */
  172 
  173 /*
  174  * Values starting with 104 are used for newly-assigned link-layer
  175  * header type values; for those link-layer header types, the DLT_
  176  * value returned by pcap_datalink() and passed to pcap_open_dead(),
  177  * and the LINKTYPE_ value that appears in capture files, are the
  178  * same.
  179  *
  180  * DLT_MATCHING_MIN is the lowest such value; DLT_MATCHING_MAX is
  181  * the highest such value.
  182  */
  183 #define DLT_MATCHING_MIN        104
  184 
  185 /*
  186  * This value was defined by libpcap 0.5; platforms that have defined
  187  * it with a different value should define it here with that value -
  188  * a link type of 104 in a save file will be mapped to DLT_C_HDLC,
  189  * whatever value that happens to be, so programs will correctly
  190  * handle files with that link type regardless of the value of
  191  * DLT_C_HDLC.
  192  *
  193  * The name DLT_C_HDLC was used by BSD/OS; we use that name for source
  194  * compatibility with programs written for BSD/OS.
  195  *
  196  * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
  197  * for source compatibility with programs written for libpcap 0.5.
  198  */
  199 #define DLT_C_HDLC      104     /* Cisco HDLC */
  200 #define DLT_CHDLC       DLT_C_HDLC
  201 
  202 #define DLT_IEEE802_11  105     /* IEEE 802.11 wireless */
  203 
  204 /*
  205  * 106 is reserved for Linux Classical IP over ATM; it's like DLT_RAW,
  206  * except when it isn't.  (I.e., sometimes it's just raw IP, and
  207  * sometimes it isn't.)  We currently handle it as DLT_LINUX_SLL,
  208  * so that we don't have to worry about the link-layer header.)
  209  */
  210 
  211 /*
  212  * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides
  213  * with other values.
  214  * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header
  215  * (DLCI, etc.).
  216  */
  217 #define DLT_FRELAY      107
  218 
  219 /*
  220  * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
  221  * that the AF_ type in the link-layer header is in network byte order.
  222  *
  223  * DLT_LOOP is 12 in OpenBSD, but that's DLT_RAW in other OSes, so
  224  * we don't use 12 for it in OSes other than OpenBSD.
  225  */
  226 #ifdef __OpenBSD__
  227 #define DLT_LOOP        12
  228 #else
  229 #define DLT_LOOP        108
  230 #endif
  231 
  232 /*
  233  * Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's
  234  * DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other
  235  * than OpenBSD.
  236  */
  237 #ifdef __OpenBSD__
  238 #define DLT_ENC         13
  239 #else
  240 #define DLT_ENC         109
  241 #endif
  242 
  243 /*
  244  * Values between 110 and 112 are reserved for use in capture file headers
  245  * as link-layer types corresponding to DLT_ types that might differ
  246  * between platforms; don't use those values for new DLT_ types
  247  * other than the corresponding DLT_ types.
  248  */
  249 
  250 /*
  251  * This is for Linux cooked sockets.
  252  */
  253 #define DLT_LINUX_SLL   113
  254 
  255 /*
  256  * Apple LocalTalk hardware.
  257  */
  258 #define DLT_LTALK       114
  259 
  260 /*
  261  * Acorn Econet.
  262  */
  263 #define DLT_ECONET      115
  264 
  265 /*
  266  * Reserved for use with OpenBSD ipfilter.
  267  */
  268 #define DLT_IPFILTER    116
  269 
  270 /*
  271  * OpenBSD DLT_PFLOG.
  272  */
  273 #define DLT_PFLOG       117
  274 
  275 /*
  276  * Registered for Cisco-internal use.
  277  */
  278 #define DLT_CISCO_IOS   118
  279 
  280 /*
  281  * For 802.11 cards using the Prism II chips, with a link-layer
  282  * header including Prism monitor mode information plus an 802.11
  283  * header.
  284  */
  285 #define DLT_PRISM_HEADER        119
  286 
  287 /*
  288  * Reserved for Aironet 802.11 cards, with an Aironet link-layer header
  289  * (see Doug Ambrisko's FreeBSD patches).
  290  */
  291 #define DLT_AIRONET_HEADER      120
  292 
  293 /*
  294  * Sigh.
  295  *
  296  * 121 was reserved for Siemens HiPath HDLC on 2002-01-25, as
  297  * requested by Tomas Kukosa.
  298  *
  299  * On 2004-02-25, a FreeBSD checkin to sys/net/bpf.h was made that
  300  * assigned 121 as DLT_PFSYNC.  In current versions, its libpcap
  301  * does DLT_ <-> LINKTYPE_ mapping, mapping DLT_PFSYNC to a
  302  * LINKTYPE_PFSYNC value of 246, so it should write out DLT_PFSYNC
  303  * dump files with 246 as the link-layer header type.  (Earlier
  304  * versions might not have done mapping, in which case they would
  305  * have written them out with a link-layer header type of 121.)
  306  *
  307  * OpenBSD, from which pf came, however, uses 18 for DLT_PFSYNC;
  308  * its libpcap does no DLT_ <-> LINKTYPE_ mapping, so it would
  309  * write out DLT_PFSYNC dump files with use 18 as the link-layer
  310  * header type.
  311  *
  312  * NetBSD, DragonFly BSD, and Darwin also use 18 for DLT_PFSYNC; in
  313  * current versions, their libpcaps do DLT_ <-> LINKTYPE_ mapping,
  314  * mapping DLT_PFSYNC to a LINKTYPE_PFSYNC value of 246, so they
  315  * should write out DLT_PFSYNC dump files with 246 as the link-layer
  316  * header type.  (Earlier versions might not have done mapping,
  317  * in which case they'd work the same way OpenBSD does, writing
  318  * them out with a link-layer header type of 18.)
  319  *
  320  * We'll define DLT_PFSYNC as:
  321  *
  322  *    18 on NetBSD, OpenBSD, DragonFly BSD, and Darwin;
  323  *
  324  *    121 on FreeBSD;
  325  *
  326  *    246 everywhere else.
  327  *
  328  * We'll define DLT_HHDLC as 121 on everything except for FreeBSD;
  329  * anybody who wants to compile, on FreeBSD, code that uses DLT_HHDLC
  330  * is out of luck.
  331  *
  332  * We'll define LINKTYPE_PFSYNC as 246 on *all* platforms, so that
  333  * savefiles written using *this* code won't use 18 or 121 for PFSYNC,
  334  * they'll all use 246.
  335  *
  336  * Code that uses pcap_datalink() to determine the link-layer header
  337  * type of a savefile won't, when built and run on FreeBSD, be able
  338  * to distinguish between LINKTYPE_PFSYNC and LINKTYPE_HHDLC capture
  339  * files, as pcap_datalink() will give 121 for both of them.  Code
  340  * that doesn't, such as the code in Wireshark, will be able to
  341  * distinguish between them.
  342  *
  343  * FreeBSD's libpcap won't map a link-layer header type of 18 - i.e.,
  344  * DLT_PFSYNC files from OpenBSD and possibly older versions of NetBSD,
  345  * DragonFly BSD, and macOS - to DLT_PFSYNC, so code built with FreeBSD's
  346  * libpcap won't treat those files as DLT_PFSYNC files.
  347  *
  348  * Other libpcaps won't map a link-layer header type of 121 to DLT_PFSYNC;
  349  * this means they can read DLT_HHDLC files, if any exist, but won't
  350  * treat pcap files written by any older versions of FreeBSD libpcap that
  351  * didn't map to 246 as DLT_PFSYNC files.
  352  */
  353 #ifdef __FreeBSD__
  354 #define DLT_PFSYNC              121
  355 #else
  356 #define DLT_HHDLC               121
  357 #endif
  358 
  359 /*
  360  * This is for RFC 2625 IP-over-Fibre Channel.
  361  *
  362  * This is not for use with raw Fibre Channel, where the link-layer
  363  * header starts with a Fibre Channel frame header; it's for IP-over-FC,
  364  * where the link-layer header starts with an RFC 2625 Network_Header
  365  * field.
  366  */
  367 #define DLT_IP_OVER_FC          122
  368 
  369 /*
  370  * This is for Full Frontal ATM on Solaris with SunATM, with a
  371  * pseudo-header followed by an AALn PDU.
  372  *
  373  * There may be other forms of Full Frontal ATM on other OSes,
  374  * with different pseudo-headers.
  375  *
  376  * If ATM software returns a pseudo-header with VPI/VCI information
  377  * (and, ideally, packet type information, e.g. signalling, ILMI,
  378  * LANE, LLC-multiplexed traffic, etc.), it should not use
  379  * DLT_ATM_RFC1483, but should get a new DLT_ value, so tcpdump
  380  * and the like don't have to infer the presence or absence of a
  381  * pseudo-header and the form of the pseudo-header.
  382  */
  383 #define DLT_SUNATM              123     /* Solaris+SunATM */
  384 
  385 /*
  386  * Reserved as per request from Kent Dahlgren <kent@praesum.com>
  387  * for private use.
  388  */
  389 #define DLT_RIO                 124     /* RapidIO */
  390 #define DLT_PCI_EXP             125     /* PCI Express */
  391 #define DLT_AURORA              126     /* Xilinx Aurora link layer */
  392 
  393 /*
  394  * Header for 802.11 plus a number of bits of link-layer information
  395  * including radio information, used by some recent BSD drivers as
  396  * well as the madwifi Atheros driver for Linux.
  397  */
  398 #define DLT_IEEE802_11_RADIO    127     /* 802.11 plus radiotap radio header */
  399 
  400 /*
  401  * Reserved for the TZSP encapsulation, as per request from
  402  * Chris Waters <chris.waters@networkchemistry.com>
  403  * TZSP is a generic encapsulation for any other link type,
  404  * which includes a means to include meta-information
  405  * with the packet, e.g. signal strength and channel
  406  * for 802.11 packets.
  407  */
  408 #define DLT_TZSP                128     /* Tazmen Sniffer Protocol */
  409 
  410 /*
  411  * BSD's ARCNET headers have the source host, destination host,
  412  * and type at the beginning of the packet; that's what's handed
  413  * up to userland via BPF.
  414  *
  415  * Linux's ARCNET headers, however, have a 2-byte offset field
  416  * between the host IDs and the type; that's what's handed up
  417  * to userland via PF_PACKET sockets.
  418  *
  419  * We therefore have to have separate DLT_ values for them.
  420  */
  421 #define DLT_ARCNET_LINUX        129     /* ARCNET */
  422 
  423 /*
  424  * Juniper-private data link types, as per request from
  425  * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
  426  * for passing on chassis-internal metainformation such as
  427  * QOS profiles, etc..
  428  */
  429 #define DLT_JUNIPER_MLPPP       130
  430 #define DLT_JUNIPER_MLFR        131
  431 #define DLT_JUNIPER_ES          132
  432 #define DLT_JUNIPER_GGSN        133
  433 #define DLT_JUNIPER_MFR         134
  434 #define DLT_JUNIPER_ATM2        135
  435 #define DLT_JUNIPER_SERVICES    136
  436 #define DLT_JUNIPER_ATM1        137
  437 
  438 /*
  439  * Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund
  440  * <dieter@apple.com>.  The header that's presented is an Ethernet-like
  441  * header:
  442  *
  443  *      #define FIREWIRE_EUI64_LEN      8
  444  *      struct firewire_header {
  445  *              u_char  firewire_dhost[FIREWIRE_EUI64_LEN];
  446  *              u_char  firewire_shost[FIREWIRE_EUI64_LEN];
  447  *              u_short firewire_type;
  448  *      };
  449  *
  450  * with "firewire_type" being an Ethernet type value, rather than,
  451  * for example, raw GASP frames being handed up.
  452  */
  453 #define DLT_APPLE_IP_OVER_IEEE1394      138
  454 
  455 /*
  456  * Various SS7 encapsulations, as per a request from Jeff Morriss
  457  * <jeff.morriss[AT]ulticom.com> and subsequent discussions.
  458  */
  459 #define DLT_MTP2_WITH_PHDR      139     /* pseudo-header with various info, followed by MTP2 */
  460 #define DLT_MTP2                140     /* MTP2, without pseudo-header */
  461 #define DLT_MTP3                141     /* MTP3, without pseudo-header or MTP2 */
  462 #define DLT_SCCP                142     /* SCCP, without pseudo-header or MTP2 or MTP3 */
  463 
  464 /*
  465  * DOCSIS MAC frames.
  466  */
  467 #define DLT_DOCSIS              143
  468 
  469 /*
  470  * Linux-IrDA packets. Protocol defined at http://www.irda.org.
  471  * Those packets include IrLAP headers and above (IrLMP...), but
  472  * don't include Phy framing (SOF/EOF/CRC & byte stuffing), because Phy
  473  * framing can be handled by the hardware and depend on the bitrate.
  474  * This is exactly the format you would get capturing on a Linux-IrDA
  475  * interface (irdaX), but not on a raw serial port.
  476  * Note the capture is done in "Linux-cooked" mode, so each packet include
  477  * a fake packet header (struct sll_header). This is because IrDA packet
  478  * decoding is dependant on the direction of the packet (incomming or
  479  * outgoing).
  480  * When/if other platform implement IrDA capture, we may revisit the
  481  * issue and define a real DLT_IRDA...
  482  * Jean II
  483  */
  484 #define DLT_LINUX_IRDA          144
  485 
  486 /*
  487  * Reserved for IBM SP switch and IBM Next Federation switch.
  488  */
  489 #define DLT_IBM_SP              145
  490 #define DLT_IBM_SN              146
  491 
  492 /*
  493  * Reserved for private use.  If you have some link-layer header type
  494  * that you want to use within your organization, with the capture files
  495  * using that link-layer header type not ever be sent outside your
  496  * organization, you can use these values.
  497  *
  498  * No libpcap release will use these for any purpose, nor will any
  499  * tcpdump release use them, either.
  500  *
  501  * Do *NOT* use these in capture files that you expect anybody not using
  502  * your private versions of capture-file-reading tools to read; in
  503  * particular, do *NOT* use them in products, otherwise you may find that
  504  * people won't be able to use tcpdump, or snort, or Ethereal, or... to
  505  * read capture files from your firewall/intrusion detection/traffic
  506  * monitoring/etc. appliance, or whatever product uses that DLT_ value,
  507  * and you may also find that the developers of those applications will
  508  * not accept patches to let them read those files.
  509  *
  510  * Also, do not use them if somebody might send you a capture using them
  511  * for *their* private type and tools using them for *your* private type
  512  * would have to read them.
  513  *
  514  * Instead, ask "tcpdump-workers@lists.tcpdump.org" for a new DLT_ value,
  515  * as per the comment above, and use the type you're given.
  516  */
  517 #define DLT_USER0               147
  518 #define DLT_USER1               148
  519 #define DLT_USER2               149
  520 #define DLT_USER3               150
  521 #define DLT_USER4               151
  522 #define DLT_USER5               152
  523 #define DLT_USER6               153
  524 #define DLT_USER7               154
  525 #define DLT_USER8               155
  526 #define DLT_USER9               156
  527 #define DLT_USER10              157
  528 #define DLT_USER11              158
  529 #define DLT_USER12              159
  530 #define DLT_USER13              160
  531 #define DLT_USER14              161
  532 #define DLT_USER15              162
  533 
  534 /*
  535  * For future use with 802.11 captures - defined by AbsoluteValue
  536  * Systems to store a number of bits of link-layer information
  537  * including radio information:
  538  *
  539  *      http://www.shaftnet.org/~pizza/software/capturefrm.txt
  540  *
  541  * but it might be used by some non-AVS drivers now or in the
  542  * future.
  543  */
  544 #define DLT_IEEE802_11_RADIO_AVS 163    /* 802.11 plus AVS radio header */
  545 
  546 /*
  547  * Juniper-private data link type, as per request from
  548  * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
  549  * for passing on chassis-internal metainformation such as
  550  * QOS profiles, etc..
  551  */
  552 #define DLT_JUNIPER_MONITOR     164
  553 
  554 /*
  555  * BACnet MS/TP frames.
  556  */
  557 #define DLT_BACNET_MS_TP        165
  558 
  559 /*
  560  * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>.
  561  *
  562  * This is used in some OSes to allow a kernel socket filter to distinguish
  563  * between incoming and outgoing packets, on a socket intended to
  564  * supply pppd with outgoing packets so it can do dial-on-demand and
  565  * hangup-on-lack-of-demand; incoming packets are filtered out so they
  566  * don't cause pppd to hold the connection up (you don't want random
  567  * input packets such as port scans, packets from old lost connections,
  568  * etc. to force the connection to stay up).
  569  *
  570  * The first byte of the PPP header (0xff03) is modified to accommodate
  571  * the direction - 0x00 = IN, 0x01 = OUT.
  572  */
  573 #define DLT_PPP_PPPD            166
  574 
  575 /*
  576  * Names for backwards compatibility with older versions of some PPP
  577  * software; new software should use DLT_PPP_PPPD.
  578  */
  579 #define DLT_PPP_WITH_DIRECTION  DLT_PPP_PPPD
  580 #define DLT_LINUX_PPP_WITHDIRECTION     DLT_PPP_PPPD
  581 
  582 /*
  583  * Juniper-private data link type, as per request from
  584  * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
  585  * for passing on chassis-internal metainformation such as
  586  * QOS profiles, cookies, etc..
  587  */
  588 #define DLT_JUNIPER_PPPOE       167
  589 #define DLT_JUNIPER_PPPOE_ATM   168
  590 
  591 #define DLT_GPRS_LLC            169     /* GPRS LLC */
  592 #define DLT_GPF_T               170     /* GPF-T (ITU-T G.7041/Y.1303) */
  593 #define DLT_GPF_F               171     /* GPF-F (ITU-T G.7041/Y.1303) */
  594 
  595 /*
  596  * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line
  597  * monitoring equipment.
  598  */
  599 #define DLT_GCOM_T1E1           172
  600 #define DLT_GCOM_SERIAL         173
  601 
  602 /*
  603  * Juniper-private data link type, as per request from
  604  * Hannes Gredler <hannes@juniper.net>.  The DLT_ is used
  605  * for internal communication to Physical Interface Cards (PIC)
  606  */
  607 #define DLT_JUNIPER_PIC_PEER    174
  608 
  609 /*
  610  * Link types requested by Gregor Maier <gregor@endace.com> of Endace
  611  * Measurement Systems.  They add an ERF header (see
  612  * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of
  613  * the link-layer header.
  614  */
  615 #define DLT_ERF_ETH             175     /* Ethernet */
  616 #define DLT_ERF_POS             176     /* Packet-over-SONET */
  617 
  618 /*
  619  * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD
  620  * for vISDN (http://www.orlandi.com/visdn/).  Its link-layer header
  621  * includes additional information before the LAPD header, so it's
  622  * not necessarily a generic LAPD header.
  623  */
  624 #define DLT_LINUX_LAPD          177
  625 
  626 /*
  627  * Juniper-private data link type, as per request from
  628  * Hannes Gredler <hannes@juniper.net>.
  629  * The DLT_ are used for prepending meta-information
  630  * like interface index, interface name
  631  * before standard Ethernet, PPP, Frelay & C-HDLC Frames
  632  */
  633 #define DLT_JUNIPER_ETHER       178
  634 #define DLT_JUNIPER_PPP         179
  635 #define DLT_JUNIPER_FRELAY      180
  636 #define DLT_JUNIPER_CHDLC       181
  637 
  638 /*
  639  * Multi Link Frame Relay (FRF.16)
  640  */
  641 #define DLT_MFR                 182
  642 
  643 /*
  644  * Juniper-private data link type, as per request from
  645  * Hannes Gredler <hannes@juniper.net>.
  646  * The DLT_ is used for internal communication with a
  647  * voice Adapter Card (PIC)
  648  */
  649 #define DLT_JUNIPER_VP          183
  650 
  651 /*
  652  * Arinc 429 frames.
  653  * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
  654  * Every frame contains a 32bit A429 label.
  655  * More documentation on Arinc 429 can be found at
  656  * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
  657  */
  658 #define DLT_A429                184
  659 
  660 /*
  661  * Arinc 653 Interpartition Communication messages.
  662  * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
  663  * Please refer to the A653-1 standard for more information.
  664  */
  665 #define DLT_A653_ICM            185
  666 
  667 /*
  668  * This used to be "USB packets, beginning with a USB setup header;
  669  * requested by Paolo Abeni <paolo.abeni@email.it>."
  670  *
  671  * However, that header didn't work all that well - it left out some
  672  * useful information - and was abandoned in favor of the DLT_USB_LINUX
  673  * header.
  674  *
  675  * This is now used by FreeBSD for its BPF taps for USB; that has its
  676  * own headers.  So it is written, so it is done.
  677  *
  678  * For source-code compatibility, we also define DLT_USB to have this
  679  * value.  We do it numerically so that, if code that includes this
  680  * file (directly or indirectly) also includes an OS header that also
  681  * defines DLT_USB as 186, we don't get a redefinition warning.
  682  * (NetBSD 7 does that.)
  683  */
  684 #define DLT_USB_FREEBSD         186
  685 #define DLT_USB                 186
  686 
  687 /*
  688  * Bluetooth HCI UART transport layer (part H:4); requested by
  689  * Paolo Abeni.
  690  */
  691 #define DLT_BLUETOOTH_HCI_H4    187
  692 
  693 /*
  694  * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
  695  * <cruz_petagay@bah.com>.
  696  */
  697 #define DLT_IEEE802_16_MAC_CPS  188
  698 
  699 /*
  700  * USB packets, beginning with a Linux USB header; requested by
  701  * Paolo Abeni <paolo.abeni@email.it>.
  702  */
  703 #define DLT_USB_LINUX           189
  704 
  705 /*
  706  * Controller Area Network (CAN) v. 2.0B packets.
  707  * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
  708  * Used to dump CAN packets coming from a CAN Vector board.
  709  * More documentation on the CAN v2.0B frames can be found at
  710  * http://www.can-cia.org/downloads/?269
  711  */
  712 #define DLT_CAN20B              190
  713 
  714 /*
  715  * IEEE 802.15.4, with address fields padded, as is done by Linux
  716  * drivers; requested by Juergen Schimmer.
  717  */
  718 #define DLT_IEEE802_15_4_LINUX  191
  719 
  720 /*
  721  * Per Packet Information encapsulated packets.
  722  * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
  723  */
  724 #define DLT_PPI                 192
  725 
  726 /*
  727  * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
  728  * requested by Charles Clancy.
  729  */
  730 #define DLT_IEEE802_16_MAC_CPS_RADIO    193
  731 
  732 /*
  733  * Juniper-private data link type, as per request from
  734  * Hannes Gredler <hannes@juniper.net>.
  735  * The DLT_ is used for internal communication with a
  736  * integrated service module (ISM).
  737  */
  738 #define DLT_JUNIPER_ISM         194
  739 
  740 /*
  741  * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
  742  * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.
  743  * For this one, we expect the FCS to be present at the end of the frame;
  744  * if the frame has no FCS, DLT_IEEE802_15_4_NOFCS should be used.
  745  */
  746 #define DLT_IEEE802_15_4        195
  747 
  748 /*
  749  * Various link-layer types, with a pseudo-header, for SITA
  750  * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).
  751  */
  752 #define DLT_SITA                196
  753 
  754 /*
  755  * Various link-layer types, with a pseudo-header, for Endace DAG cards;
  756  * encapsulates Endace ERF records.  Requested by Stephen Donnelly
  757  * <stephen@endace.com>.
  758  */
  759 #define DLT_ERF                 197
  760 
  761 /*
  762  * Special header prepended to Ethernet packets when capturing from a
  763  * u10 Networks board.  Requested by Phil Mulholland
  764  * <phil@u10networks.com>.
  765  */
  766 #define DLT_RAIF1               198
  767 
  768 /*
  769  * IPMB packet for IPMI, beginning with the I2C slave address, followed
  770  * by the netFn and LUN, etc..  Requested by Chanthy Toeung
  771  * <chanthy.toeung@ca.kontron.com>.
  772  * 
  773  * XXX - this used to be called DLT_IPMB, back when we got the
  774  * impression from the email thread requesting it that the packet
  775  * had no extra 2-byte header.  We've renamed it; if anybody used
  776  * DLT_IPMB and assumed no 2-byte header, this will cause the compile
  777  * to fail, at which point we'll have to figure out what to do about
  778  * the two header types using the same DLT_/LINKTYPE_ value.  If that
  779  * doesn't happen, we'll assume nobody used it and that the redefinition
  780  * is safe.
  781  */
  782 #define DLT_IPMB_KONTRON        199
  783 
  784 /*
  785  * Juniper-private data link type, as per request from
  786  * Hannes Gredler <hannes@juniper.net>.
  787  * The DLT_ is used for capturing data on a secure tunnel interface.
  788  */
  789 #define DLT_JUNIPER_ST          200
  790 
  791 /*
  792  * Bluetooth HCI UART transport layer (part H:4), with pseudo-header
  793  * that includes direction information; requested by Paolo Abeni.
  794  */
  795 #define DLT_BLUETOOTH_HCI_H4_WITH_PHDR  201
  796 
  797 /*
  798  * AX.25 packet with a 1-byte KISS header; see
  799  *
  800  *      http://www.ax25.net/kiss.htm
  801  *
  802  * as per Richard Stearn <richard@rns-stearn.demon.co.uk>.
  803  */
  804 #define DLT_AX25_KISS           202
  805 
  806 /*
  807  * LAPD packets from an ISDN channel, starting with the address field,
  808  * with no pseudo-header.
  809  * Requested by Varuna De Silva <varunax@gmail.com>.
  810  */
  811 #define DLT_LAPD                203
  812 
  813 /*
  814  * Variants of various link-layer headers, with a one-byte direction
  815  * pseudo-header prepended - zero means "received by this host",
  816  * non-zero (any non-zero value) means "sent by this host" - as per
  817  * Will Barker <w.barker@zen.co.uk>.
  818  */
  819 #define DLT_PPP_WITH_DIR        204     /* PPP - don't confuse with DLT_PPP_WITH_DIRECTION */
  820 #define DLT_C_HDLC_WITH_DIR     205     /* Cisco HDLC */
  821 #define DLT_FRELAY_WITH_DIR     206     /* Frame Relay */
  822 #define DLT_LAPB_WITH_DIR       207     /* LAPB */
  823 
  824 /*
  825  * 208 is reserved for an as-yet-unspecified proprietary link-layer
  826  * type, as requested by Will Barker.
  827  */
  828 
  829 /*
  830  * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman
  831  * <avn@pigeonpoint.com>.
  832  */
  833 #define DLT_IPMB_LINUX          209
  834 
  835 /*
  836  * FlexRay automotive bus - http://www.flexray.com/ - as requested
  837  * by Hannes Kaelber <hannes.kaelber@x2e.de>.
  838  */
  839 #define DLT_FLEXRAY             210
  840 
  841 /*
  842  * Media Oriented Systems Transport (MOST) bus for multimedia
  843  * transport - http://www.mostcooperation.com/ - as requested
  844  * by Hannes Kaelber <hannes.kaelber@x2e.de>.
  845  */
  846 #define DLT_MOST                211
  847 
  848 /*
  849  * Local Interconnect Network (LIN) bus for vehicle networks -
  850  * http://www.lin-subbus.org/ - as requested by Hannes Kaelber
  851  * <hannes.kaelber@x2e.de>.
  852  */
  853 #define DLT_LIN                 212
  854 
  855 /*
  856  * X2E-private data link type used for serial line capture,
  857  * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
  858  */
  859 #define DLT_X2E_SERIAL          213
  860 
  861 /*
  862  * X2E-private data link type used for the Xoraya data logger
  863  * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
  864  */
  865 #define DLT_X2E_XORAYA          214
  866 
  867 /*
  868  * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
  869  * nothing), but with the PHY-level data for non-ASK PHYs (4 octets
  870  * of 0 as preamble, one octet of SFD, one octet of frame length+
  871  * reserved bit, and then the MAC-layer data, starting with the
  872  * frame control field).
  873  *
  874  * Requested by Max Filippov <jcmvbkbc@gmail.com>.
  875  */
  876 #define DLT_IEEE802_15_4_NONASK_PHY     215
  877 
  878 /*
  879  * David Gibson <david@gibson.dropbear.id.au> requested this for
  880  * captures from the Linux kernel /dev/input/eventN devices. This
  881  * is used to communicate keystrokes and mouse movements from the
  882  * Linux kernel to display systems, such as Xorg.
  883  */
  884 #define DLT_LINUX_EVDEV         216
  885 
  886 /*
  887  * GSM Um and Abis interfaces, preceded by a "gsmtap" header.
  888  *
  889  * Requested by Harald Welte <laforge@gnumonks.org>.
  890  */
  891 #define DLT_GSMTAP_UM           217
  892 #define DLT_GSMTAP_ABIS         218
  893 
  894 /*
  895  * MPLS, with an MPLS label as the link-layer header.
  896  * Requested by Michele Marchetto <michele@openbsd.org> on behalf
  897  * of OpenBSD.
  898  */
  899 #define DLT_MPLS                219
  900 
  901 /*
  902  * USB packets, beginning with a Linux USB header, with the USB header
  903  * padded to 64 bytes; required for memory-mapped access.
  904  */
  905 #define DLT_USB_LINUX_MMAPPED   220
  906 
  907 /*
  908  * DECT packets, with a pseudo-header; requested by
  909  * Matthias Wenzel <tcpdump@mazzoo.de>.
  910  */
  911 #define DLT_DECT                221
  912 
  913 /*
  914  * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov>
  915  * Date: Mon, 11 May 2009 11:18:30 -0500
  916  *
  917  * DLT_AOS. We need it for AOS Space Data Link Protocol.
  918  *   I have already written dissectors for but need an OK from
  919  *   legal before I can submit a patch.
  920  *
  921  */
  922 #define DLT_AOS                 222
  923 
  924 /*
  925  * Wireless HART (Highway Addressable Remote Transducer)
  926  * From the HART Communication Foundation
  927  * IES/PAS 62591
  928  *
  929  * Requested by Sam Roberts <vieuxtech@gmail.com>.
  930  */
  931 #define DLT_WIHART              223
  932 
  933 /*
  934  * Fibre Channel FC-2 frames, beginning with a Frame_Header.
  935  * Requested by Kahou Lei <kahou82@gmail.com>.
  936  */
  937 #define DLT_FC_2                224
  938 
  939 /*
  940  * Fibre Channel FC-2 frames, beginning with an encoding of the
  941  * SOF, and ending with an encoding of the EOF.
  942  *
  943  * The encodings represent the frame delimiters as 4-byte sequences
  944  * representing the corresponding ordered sets, with K28.5
  945  * represented as 0xBC, and the D symbols as the corresponding
  946  * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2,
  947  * is represented as 0xBC 0xB5 0x55 0x55.
  948  *
  949  * Requested by Kahou Lei <kahou82@gmail.com>.
  950  */
  951 #define DLT_FC_2_WITH_FRAME_DELIMS      225
  952 
  953 /*
  954  * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>.
  955  *
  956  * The pseudo-header starts with a one-byte version number; for version 2,
  957  * the pseudo-header is:
  958  *
  959  * struct dl_ipnetinfo {
  960  *     uint8_t   dli_version;
  961  *     uint8_t   dli_family;
  962  *     uint16_t  dli_htype;
  963  *     uint32_t  dli_pktlen;
  964  *     uint32_t  dli_ifindex;
  965  *     uint32_t  dli_grifindex;
  966  *     uint32_t  dli_zsrc;
  967  *     uint32_t  dli_zdst;
  968  * };
  969  *
  970  * dli_version is 2 for the current version of the pseudo-header.
  971  *
  972  * dli_family is a Solaris address family value, so it's 2 for IPv4
  973  * and 26 for IPv6.
  974  *
  975  * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing
  976  * packets, and 2 for packets arriving from another zone on the same
  977  * machine.
  978  *
  979  * dli_pktlen is the length of the packet data following the pseudo-header
  980  * (so the captured length minus dli_pktlen is the length of the
  981  * pseudo-header, assuming the entire pseudo-header was captured).
  982  *
  983  * dli_ifindex is the interface index of the interface on which the
  984  * packet arrived.
  985  *
  986  * dli_grifindex is the group interface index number (for IPMP interfaces).
  987  *
  988  * dli_zsrc is the zone identifier for the source of the packet.
  989  *
  990  * dli_zdst is the zone identifier for the destination of the packet.
  991  *
  992  * A zone number of 0 is the global zone; a zone number of 0xffffffff
  993  * means that the packet arrived from another host on the network, not
  994  * from another zone on the same machine.
  995  *
  996  * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates
  997  * which of those it is.
  998  */
  999 #define DLT_IPNET               226
 1000 
 1001 /*
 1002  * CAN (Controller Area Network) frames, with a pseudo-header as supplied
 1003  * by Linux SocketCAN, and with multi-byte numerical fields in that header
 1004  * in big-endian byte order.
 1005  *
 1006  * See Documentation/networking/can.txt in the Linux source.
 1007  *
 1008  * Requested by Felix Obenhuber <felix@obenhuber.de>.
 1009  */
 1010 #define DLT_CAN_SOCKETCAN       227
 1011 
 1012 /*
 1013  * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies
 1014  * whether it's v4 or v6.  Requested by Darren Reed <Darren.Reed@Sun.COM>.
 1015  */
 1016 #define DLT_IPV4                228
 1017 #define DLT_IPV6                229
 1018 
 1019 /*
 1020  * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
 1021  * nothing), and with no FCS at the end of the frame; requested by
 1022  * Jon Smirl <jonsmirl@gmail.com>.
 1023  */
 1024 #define DLT_IEEE802_15_4_NOFCS  230
 1025 
 1026 /*
 1027  * Raw D-Bus:
 1028  *
 1029  *      http://www.freedesktop.org/wiki/Software/dbus
 1030  *
 1031  * messages:
 1032  *
 1033  *      http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages
 1034  *
 1035  * starting with the endianness flag, followed by the message type, etc.,
 1036  * but without the authentication handshake before the message sequence:
 1037  *
 1038  *      http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol
 1039  *
 1040  * Requested by Martin Vidner <martin@vidner.net>.
 1041  */
 1042 #define DLT_DBUS                231
 1043 
 1044 /*
 1045  * Juniper-private data link type, as per request from
 1046  * Hannes Gredler <hannes@juniper.net>.
 1047  */
 1048 #define DLT_JUNIPER_VS                  232
 1049 #define DLT_JUNIPER_SRX_E2E             233
 1050 #define DLT_JUNIPER_FIBRECHANNEL        234
 1051 
 1052 /*
 1053  * DVB-CI (DVB Common Interface for communication between a PC Card
 1054  * module and a DVB receiver).  See
 1055  *
 1056  *      http://www.kaiser.cx/pcap-dvbci.html
 1057  *
 1058  * for the specification.
 1059  *
 1060  * Requested by Martin Kaiser <martin@kaiser.cx>.
 1061  */
 1062 #define DLT_DVB_CI              235
 1063 
 1064 /*
 1065  * Variant of 3GPP TS 27.010 multiplexing protocol (similar to, but
 1066  * *not* the same as, 27.010).  Requested by Hans-Christoph Schemmel
 1067  * <hans-christoph.schemmel@cinterion.com>.
 1068  */
 1069 #define DLT_MUX27010            236
 1070 
 1071 /*
 1072  * STANAG 5066 D_PDUs.  Requested by M. Baris Demiray
 1073  * <barisdemiray@gmail.com>.
 1074  */
 1075 #define DLT_STANAG_5066_D_PDU   237
 1076 
 1077 /*
 1078  * Juniper-private data link type, as per request from
 1079  * Hannes Gredler <hannes@juniper.net>.
 1080  */
 1081 #define DLT_JUNIPER_ATM_CEMIC   238
 1082 
 1083 /*
 1084  * NetFilter LOG messages
 1085  * (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets)
 1086  *
 1087  * Requested by Jakub Zawadzki <darkjames-ws@darkjames.pl>
 1088  */
 1089 #define DLT_NFLOG               239
 1090 
 1091 /*
 1092  * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
 1093  * for Ethernet packets with a 4-byte pseudo-header and always
 1094  * with the payload including the FCS, as supplied by their
 1095  * netANALYZER hardware and software.
 1096  *
 1097  * Requested by Holger P. Frommer <HPfrommer@hilscher.com>
 1098  */
 1099 #define DLT_NETANALYZER         240
 1100 
 1101 /*
 1102  * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
 1103  * for Ethernet packets with a 4-byte pseudo-header and FCS and
 1104  * with the Ethernet header preceded by 7 bytes of preamble and
 1105  * 1 byte of SFD, as supplied by their netANALYZER hardware and
 1106  * software.
 1107  *
 1108  * Requested by Holger P. Frommer <HPfrommer@hilscher.com>
 1109  */
 1110 #define DLT_NETANALYZER_TRANSPARENT     241
 1111 
 1112 /*
 1113  * IP-over-InfiniBand, as specified by RFC 4391.
 1114  *
 1115  * Requested by Petr Sumbera <petr.sumbera@oracle.com>.
 1116  */
 1117 #define DLT_IPOIB               242
 1118 
 1119 /*
 1120  * MPEG-2 transport stream (ISO 13818-1/ITU-T H.222.0).
 1121  *
 1122  * Requested by Guy Martin <gmsoft@tuxicoman.be>.
 1123  */
 1124 #define DLT_MPEG_2_TS           243
 1125 
 1126 /*
 1127  * ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as
 1128  * used by their ng40 protocol tester.
 1129  *
 1130  * Requested by Jens Grimmer <jens.grimmer@ng4t.com>.
 1131  */
 1132 #define DLT_NG40                244
 1133 
 1134 /*
 1135  * Pseudo-header giving adapter number and flags, followed by an NFC
 1136  * (Near-Field Communications) Logical Link Control Protocol (LLCP) PDU,
 1137  * as specified by NFC Forum Logical Link Control Protocol Technical
 1138  * Specification LLCP 1.1.
 1139  *
 1140  * Requested by Mike Wakerly <mikey@google.com>.
 1141  */
 1142 #define DLT_NFC_LLCP            245
 1143 
 1144 /*
 1145  * 246 is used as LINKTYPE_PFSYNC; do not use it for any other purpose.
 1146  *
 1147  * DLT_PFSYNC has different values on different platforms, and all of
 1148  * them collide with something used elsewhere.  On platforms that
 1149  * don't already define it, define it as 246.
 1150  */
 1151 #if !defined(__FreeBSD__) && !defined(__OpenBSD__) && !defined(__NetBSD__) && !defined(__DragonFly__) && !defined(__APPLE__)
 1152 #define DLT_PFSYNC              246
 1153 #endif
 1154 
 1155 /*
 1156  * Raw InfiniBand packets, starting with the Local Routing Header.
 1157  *
 1158  * Requested by Oren Kladnitsky <orenk@mellanox.com>.
 1159  */
 1160 #define DLT_INFINIBAND          247
 1161 
 1162 /*
 1163  * SCTP, with no lower-level protocols (i.e., no IPv4 or IPv6).
 1164  *
 1165  * Requested by Michael Tuexen <Michael.Tuexen@lurchi.franken.de>.
 1166  */
 1167 #define DLT_SCTP                248
 1168 
 1169 /*
 1170  * USB packets, beginning with a USBPcap header.
 1171  *
 1172  * Requested by Tomasz Mon <desowin@gmail.com>
 1173  */
 1174 #define DLT_USBPCAP             249
 1175 
 1176 /*
 1177  * Schweitzer Engineering Laboratories "RTAC" product serial-line
 1178  * packets.
 1179  *
 1180  * Requested by Chris Bontje <chris_bontje@selinc.com>.
 1181  */
 1182 #define DLT_RTAC_SERIAL         250
 1183 
 1184 /*
 1185  * Bluetooth Low Energy air interface link-layer packets.
 1186  *
 1187  * Requested by Mike Kershaw <dragorn@kismetwireless.net>.
 1188  */
 1189 #define DLT_BLUETOOTH_LE_LL     251
 1190 
 1191 /*
 1192  * DLT type for upper-protocol layer PDU saves from wireshark.
 1193  *
 1194  * the actual contents are determined by two TAGs stored with each
 1195  * packet:
 1196  *   EXP_PDU_TAG_LINKTYPE          the link type (LINKTYPE_ value) of the
 1197  *                                 original packet.
 1198  *
 1199  *   EXP_PDU_TAG_PROTO_NAME        the name of the wireshark dissector
 1200  *                                 that can make sense of the data stored.
 1201  */
 1202 #define DLT_WIRESHARK_UPPER_PDU 252
 1203 
 1204 /*
 1205  * DLT type for the netlink protocol (nlmon devices).
 1206  */
 1207 #define DLT_NETLINK             253
 1208 
 1209 /*
 1210  * Bluetooth Linux Monitor headers for the BlueZ stack.
 1211  */
 1212 #define DLT_BLUETOOTH_LINUX_MONITOR     254
 1213 
 1214 /*
 1215  * Bluetooth Basic Rate/Enhanced Data Rate baseband packets, as
 1216  * captured by Ubertooth.
 1217  */
 1218 #define DLT_BLUETOOTH_BREDR_BB  255
 1219 
 1220 /*
 1221  * Bluetooth Low Energy link layer packets, as captured by Ubertooth.
 1222  */
 1223 #define DLT_BLUETOOTH_LE_LL_WITH_PHDR   256
 1224 
 1225 /*
 1226  * PROFIBUS data link layer.
 1227  */
 1228 #define DLT_PROFIBUS_DL         257
 1229 
 1230 /*
 1231  * Apple's DLT_PKTAP headers.
 1232  *
 1233  * Sadly, the folks at Apple either had no clue that the DLT_USERn values
 1234  * are for internal use within an organization and partners only, and
 1235  * didn't know that the right way to get a link-layer header type is to
 1236  * ask tcpdump.org for one, or knew and didn't care, so they just
 1237  * used DLT_USER2, which causes problems for everything except for
 1238  * their version of tcpdump.
 1239  *
 1240  * So I'll just give them one; hopefully this will show up in a
 1241  * libpcap release in time for them to get this into 10.10 Big Sur
 1242  * or whatever Mavericks' successor is called.  LINKTYPE_PKTAP
 1243  * will be 258 *even on macOS*; that is *intentional*, so that
 1244  * PKTAP files look the same on *all* OSes (different OSes can have
 1245  * different numerical values for a given DLT_, but *MUST NOT* have
 1246  * different values for what goes in a file, as files can be moved
 1247  * between OSes!).
 1248  *
 1249  * When capturing, on a system with a Darwin-based OS, on a device
 1250  * that returns 149 (DLT_USER2 and Apple's DLT_PKTAP) with this
 1251  * version of libpcap, the DLT_ value for the pcap_t  will be DLT_PKTAP,
 1252  * and that will continue to be DLT_USER2 on Darwin-based OSes. That way,
 1253  * binary compatibility with Mavericks is preserved for programs using
 1254  * this version of libpcap.  This does mean that if you were using
 1255  * DLT_USER2 for some capture device on macOS, you can't do so with
 1256  * this version of libpcap, just as you can't with Apple's libpcap -
 1257  * on macOS, they define DLT_PKTAP to be DLT_USER2, so programs won't
 1258  * be able to distinguish between PKTAP and whatever you were using
 1259  * DLT_USER2 for.
 1260  *
 1261  * If the program saves the capture to a file using this version of
 1262  * libpcap's pcap_dump code, the LINKTYPE_ value in the file will be
 1263  * LINKTYPE_PKTAP, which will be 258, even on Darwin-based OSes.
 1264  * That way, the file will *not* be a DLT_USER2 file.  That means
 1265  * that the latest version of tcpdump, when built with this version
 1266  * of libpcap, and sufficiently recent versions of Wireshark will
 1267  * be able to read those files and interpret them correctly; however,
 1268  * Apple's version of tcpdump in OS X 10.9 won't be able to handle
 1269  * them.  (Hopefully, Apple will pick up this version of libpcap,
 1270  * and the corresponding version of tcpdump, so that tcpdump will
 1271  * be able to handle the old LINKTYPE_USER2 captures *and* the new
 1272  * LINKTYPE_PKTAP captures.)
 1273  */
 1274 #ifdef __APPLE__
 1275 #define DLT_PKTAP       DLT_USER2
 1276 #else
 1277 #define DLT_PKTAP       258
 1278 #endif
 1279 
 1280 /*
 1281  * Ethernet packets preceded by a header giving the last 6 octets
 1282  * of the preamble specified by 802.3-2012 Clause 65, section
 1283  * 65.1.3.2 "Transmit".
 1284  */
 1285 #define DLT_EPON        259
 1286 
 1287 /*
 1288  * IPMI trace packets, as specified by Table 3-20 "Trace Data Block Format"
 1289  * in the PICMG HPM.2 specification.
 1290  */
 1291 #define DLT_IPMI_HPM_2  260
 1292 
 1293 /*
 1294  * per  Joshua Wright <jwright@hasborg.com>, formats for Zwave captures.
 1295  */
 1296 #define DLT_ZWAVE_R1_R2  261
 1297 #define DLT_ZWAVE_R3     262
 1298 
 1299 /*
 1300  * per Steve Karg <skarg@users.sourceforge.net>, formats for Wattstopper
 1301  * Digital Lighting Management room bus serial protocol captures.
 1302  */
 1303 #define DLT_WATTSTOPPER_DLM     263
 1304 
 1305 /*
 1306  * ISO 14443 contactless smart card messages.
 1307  */
 1308 #define DLT_ISO_14443   264
 1309 
 1310 /*
 1311  * Radio data system (RDS) groups.  IEC 62106.
 1312  * Per Jonathan Brucker <jonathan.brucke@gmail.com>.
 1313  */
 1314 #define DLT_RDS         265
 1315 
 1316 /*
 1317  * USB packets, beginning with a Darwin (macOS, etc.) header.
 1318  */
 1319 #define DLT_USB_DARWIN  266
 1320 
 1321 /*
 1322  * OpenBSD DLT_OPENFLOW.
 1323  */
 1324 #define DLT_OPENFLOW    267
 1325 
 1326 /*
 1327  * SDLC frames containing SNA PDUs.
 1328  */
 1329 #define DLT_SDLC        268
 1330 
 1331 /*
 1332  * per "Selvig, Bjorn" <b.selvig@ti.com> used for
 1333  * TI protocol sniffer.
 1334  */
 1335 #define DLT_TI_LLN_SNIFFER      269
 1336 
 1337 /*
 1338  * per: Erik de Jong <erikdejong at gmail.com> for
 1339  *   https://github.com/eriknl/LoRaTap/releases/tag/v0.1
 1340  */
 1341 #define DLT_LORATAP             270
 1342 
 1343 /*
 1344  * per: Stefanha at gmail.com for
 1345  *   http://lists.sandelman.ca/pipermail/tcpdump-workers/2017-May/000772.html
 1346  * and: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/vsockmon.h
 1347  * for: http://qemu-project.org/Features/VirtioVsock
 1348  */
 1349 #define DLT_VSOCK               271
 1350 
 1351 /*
 1352  * Nordic Semiconductor Bluetooth LE sniffer.
 1353  */
 1354 #define DLT_NORDIC_BLE          272
 1355 
 1356 /*
 1357  * Excentis DOCSIS 3.1 RF sniffer (XRA-31)
 1358  *   per: bruno.verstuyft at excentis.com
 1359  *        http://www.xra31.com/xra-header
 1360  */
 1361 #define DLT_DOCSIS31_XRA31      273
 1362 
 1363 /*
 1364  * mPackets, as specified by IEEE 802.3br Figure 99-4, starting
 1365  * with the preamble and always ending with a CRC field.
 1366  */
 1367 #define DLT_ETHERNET_MPACKET    274
 1368 
 1369 /*
 1370  * DisplayPort AUX channel monitoring data as specified by VESA
 1371  * DisplayPort(DP) Standard preceeded by a pseudo-header.
 1372  *    per dirk.eibach at gdsys.cc
 1373  */
 1374 #define DLT_DISPLAYPORT_AUX     275
 1375 
 1376 /*
 1377  * Linux cooked sockets v2.
 1378  */
 1379 #define DLT_LINUX_SLL2  276
 1380 
 1381 /*
 1382  * In case the code that includes this file (directly or indirectly)
 1383  * has also included OS files that happen to define DLT_MATCHING_MAX,
 1384  * with a different value (perhaps because that OS hasn't picked up
 1385  * the latest version of our DLT definitions), we undefine the
 1386  * previous value of DLT_MATCHING_MAX.
 1387  */
 1388 #ifdef DLT_MATCHING_MAX
 1389 #undef DLT_MATCHING_MAX
 1390 #endif
 1391 #define DLT_MATCHING_MAX        276     /* highest value in the "matching" range */
 1392 
 1393 /*
 1394  * DLT and savefile link type values are split into a class and
 1395  * a member of that class.  A class value of 0 indicates a regular
 1396  * DLT_/LINKTYPE_ value.
 1397  */
 1398 #define DLT_CLASS(x)            ((x) & 0x03ff0000)
 1399 
 1400 /*
 1401  * NetBSD-specific generic "raw" link type.  The class value indicates
 1402  * that this is the generic raw type, and the lower 16 bits are the
 1403  * address family we're dealing with.  Those values are NetBSD-specific;
 1404  * do not assume that they correspond to AF_ values for your operating
 1405  * system.
 1406  */
 1407 #define DLT_CLASS_NETBSD_RAWAF  0x02240000
 1408 #define DLT_NETBSD_RAWAF(af)    (DLT_CLASS_NETBSD_RAWAF | (af))
 1409 #define DLT_NETBSD_RAWAF_AF(x)  ((x) & 0x0000ffff)
 1410 #define DLT_IS_NETBSD_RAWAF(x)  (DLT_CLASS(x) == DLT_CLASS_NETBSD_RAWAF)
 1411 
 1412 #endif /* !_NET_DLT_H_ */

Cache object: 375fdab19a512657505eef3033696cf2


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.