Wireshark · Ethereal-dev: Re: [ethereal-dev] IPv6 patch for loopback

[Guy Harris <gharris@xxxxxxxxxxxx>]

I've been assaulting the DLT_NULL code with a chainsaw; "libpcap"s and
BSD's DLT_NULL is a bit of an unholy mess, with three different
encapsulations:

	1) PPP-over-HDLC, where the first two octets of the header are
	   0xFF and 0x03, and the next two are a PPP protocol type - at
	   least some versions of ISDN4BSD appear to use this;

	2) Linux, wheree ARPHRD_LOOPBACK puts an *Ethernet* header at
	   the beginning of the packet, but "libpcap" edits that into
	   something with the first two octets being 0x00 and the next
	   two being an Ethernet protocol type;

	3) standard BSD, where the all four octets are an AF_ type, in
	   the byte order of the host on which the capture was done (at
	   least from looking at the code, the ISDN4BSD in the FreeBSD
	   3.2 source tree does this, so I guess either 1) I'm missing
	   something or 2) an older version used PPP-over-HDLC
	   encapsulation but claimed it was DLT_NULL).

I have some changes which I think should handle all three - I want to
test them on a big-endian machine at work, but if that works, I'll check
them in.  (They also include IPv6, at least for PPP-over-HDLC, Linux,
and FreeBSD; other BSD-derived systems may well use different AF_ values
for IPv6, and I'll have to dig those up as well.)

I'll put your patch in now.