Wireshark-dev: [Wireshark-dev] New page, giving link-layer header type values and descriptions,
http://www.tcpdump.org/linktypes.html
contains a description of all the existing link-layer header types for which there is either
1) an official standard;
2) a reasonably complete description;
3) a tcpdump or Wireshark dissector from which I could construct a reasonably complete description;
as well as a mention of the USER0 through USER15 types. If the description wasn't available elsewhere on the Web, or in a published standard, I created a description page in the http://www.tcpdump.org/linktypes directory, and linked to it.
The table of link-layer header type values gives:
the LINKTYPE_ name for the type - currently, that's only used inside libpcap, and not exported, as there are no APIs to fetch it;
the value of that LINKTYPE_ name - that's what should be used in pcap and pcap-ng capture files;
the corresponding DLT_ name - that's what's returned by the libpcap APIs;
a description of the header.
The value for the DLT_ name is *NOT* given, as it may differ from platform to platform; in most cases, it's the same as the LINKTYPE_ value, but, in a few cases, a separate LINKTYPE_ value was assigned, in an attempt to cope with different BPF-bearing systems choosing different numeric values for the same DLT_ name.
It's linked to from the menu at the top of all pages.
I've checked in a change to the pcap-linktypes man page, in the libpcap trunk and 1.1 branch, to just refer to the Web page rather than to enumerate the link-layer header types. The descriptions in pcap/bpf.h should also migrate to the linktypes.html page and subpages in the linktype directory.
