Ethereal-users: Re: [Ethereal-users] OT: How does ethereal/libpcap determine the layer 3 type?
On Wednesday, September 3, 2003, at 7:02 AM, darren wrote:
I can understand that libpcap inserts the LCS header in front if it
gets a
new ARP type that does not match its list...just wondering which
command is
it exactly that libpcap use to fetch the L3 protocol type from the
kernel
network stack?
"recvfrom()". Conveniently, that's the same call it uses to fetch the
packet data; on a PF_PACKET socket, the "from" address returned by
"recvfrom()" is a "struct sockaddr_ll" that contains, among other
things, a "Physical layer protocol" value that's an Ethernet type value
for most packets, or a special value for Ethernet packets with 802.2
headers or with raw IPX-over-802.3.
See the "packet(7)" man page.
Any reason why my card driver strips the L2 header away when I specify
the
encapsulation type?
I don't know for certain, but it could be that the driver writer had no
clue what "mac.raw" is for in a skbuff structure. Drivers *SHOULD* be
setting "mac.raw" to point to the beginning of the raw packet data, but
perhaps some driver writers Don't Get It and set it to point to the
encapsulated data.
What type of card is this? (Vendor name.) And what driver does it use?
