Wireshark · Ethereal-dev: Re: [tcpdump-workers] Re: [Ethereal-dev] Private DLT_s and WTAP_ENCAP_s

[Guy Harris <guy@xxxxxxxxxxxx>]

On Dec 19, 2003, at 5:19 PM, Guy Harris wrote:

> As long as it's made clear that there won't ever be any code in 
> tcpdump.org tcpdump or libpcap, ethereal.com Ethereal, etc. to support 
> any particular interpretations of those reserved values (i.e.,  
> anybody who uses that stuff privately will have to maintain it 
> indefinitely, and if they use it in a product, there won't ever be any 
> support in official releases for reading capture files with those 
> link-layer types), I think it'd be reasonable to have private DLT_ 
> values.

I've added DLT_USER0 through DLT_USER15 to pcap-bpf.h in the 0.8 and 
main branches, along with a comment indicating how they should - and 
should not - be used.  Hopefully that'll keep vendors of 
firewall/intrusion detection/traffic logging/etc. appliances, and the 
like, from shipping products that use those values (the comment 
specifically says that developers of software that reads libpcap-format 
captures, e.g. tcpdump and Ethereal, aren't necessarily going to accept 
patches to allow those files to be read).