Wireshark-users: Re: [Wireshark-users] arptype 65534 not supported by libpcap - falling back to c
Toralf Förster wrote:
I'm wondering what I can do to avoid that message which appears if I try
to sniff
a VPN connection established at home via DSL using AT & T Global Network
Client.
Either compile the current top-of-CVS tree version of libpcap, or apply
the attached patch to whatever version of libpcap you have, build it,
and install it.
The alternative is to ignore the message (dismiss the dialog box) - the
capture should happen, and no data should be lost. If the capture
*doesn't* happen, file a bug.
Index: pcap-linux.c
===================================================================
RCS file: /tcpdump/master/libpcap/pcap-linux.c,v
retrieving revision 1.148
diff -c -r1.148 pcap-linux.c
*** pcap-linux.c 14 Apr 2008 21:04:51 -0000 1.148
--- pcap-linux.c 24 Jun 2008 06:43:49 -0000
***************
*** 1539,1544 ****
--- 1539,1555 ----
handle->linktype = DLT_LINUX_LAPD;
break;
+ #ifndef ARPHRD_NONE
+ #define ARPHRD_NONE 0xFFFE
+ #endif
+ case ARPHRD_NONE:
+ /*
+ * No link-layer header; packets are just IP
+ * packets, so use DLT_RAW.
+ */
+ handle->linktype = DLT_RAW;
+ break;
+
default:
handle->linktype = -1;
break;
