Wireshark-dev: Re: [Wireshark-dev] gencode.c
From: Xiaochun Lu <xiaoclu@xxxxxxxxx>
Date: Fri, 5 Nov 2010 11:37:30 -0700
Hi, Guy: On Thu, Nov 4, 2010 at 4:03 PM, Guy Harris <guy@xxxxxxxxxxxx> wrote: > > On Nov 4, 2010, at 12:40 PM, Xiaochun Lu wrote: > > yes, my git version is 1.2.0-PRE-GIT. > xcrp is a regular network device. The problem is that it is not > supported by libpcap yet. I add DLT value for xcrp by myself. > > Don't do that. If you chose some value other than DLT_USER0/LINKTYPE_USER0 > through DLT_USER15/LINKTYPE_USER15 for it, at some point in the future, > there is a significant chance that the tcpdump.org developers will assign > some other DLT_/LINKTYPE_ the same numerical value (and the closer the value > you chose is to the current maximum value, the closer that point in the > future moves to the present), at which point, if you're maintaining your own > version of Wireshark, doing so will be harder, as the standard version of > Wireshark might interpret that DLT_/LINKTYPE_ value as being for something > other than xcrp packets. > If you only plan to use that link-layer type in your organization (company, > company department, university lab, government lab, personal hobby, etc.), > then you should use one of the DLT_USERn types, and maintain your own > modified versions of libpcap and Wireshark; no version of libpcap will > *EVER* use DLT_USERn values itself, and no version of Wireshark will ever > use the corresponding WTAP_ENCAP_USERn values itself. > If you plan to use that link-layer type outside your organization, you > should request that tcpdump.org assign you a DLT_ value; to request a DLT_ > value, send an email to tcpdump-workers@xxxxxxxxxxx. In that mail, if the > link-layer header format is specified by a standard (for example, IEEE 802 > networks), specify the standard; if it's not specified by a standard - this > includes a header that is based on a standard but doesn't conform to the > standard because, for example, it adds extra padding to the header - then > describe the header in detail. > XCRP act as multiplexer between layer 2 and layer3. It is not a standard interface. I guess it will be difficult to get DLT_value from tcpdump.org. Using DLT_USERn fits my need too. > Right now, I can capture packets without capture filter. Then I can > apply read filter when read it out from pcap file. seems to me that I > need add > some special code for DLT_XCRP in gen_linktype(protol). > > If you don't care whether you can use a capture filter with your link-layer > type, then add to gen_linktype() a case statement such as > case DLT_XCRP: > bpf_error("XCRP link-layer type filtering not implemented"); > before the > /* > * All the types that have no encapsulation should either be > * handled as DLT_SLIP, DLT_SLIP_BSDOS, and DLT_RAW are, if > * all packets are IP packets, or should be handled in some > * special case, if none of them are (if some are and some > * aren't, the lack of encapsulation is a problem, as we'd > * have to find some other way of determining the packet type). > * > * Therefore, if "off_linktype" is -1, there's an error. > */ > if (off_linktype == (u_int)-1) > abort(); > > code (which is probably the code that's calling abort()). > If you *do* care, you'll have to add some more code to libpcap; you should > probably ask about that on tcpdump-workers@xxxxxxxxxxx. > I will do it. Thanks shawn___________________________________________________________________________ > Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx> > Archives: http://www.wireshark.org/lists/wireshark-dev > Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev > mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe >
- References:
- [Wireshark-dev] gencode.c
- From: Xiaochun Lu
- Re: [Wireshark-dev] gencode.c
- From: Guy Harris
- Re: [Wireshark-dev] gencode.c
- From: Xiaochun Lu
- Re: [Wireshark-dev] gencode.c
- From: Guy Harris
- Re: [Wireshark-dev] gencode.c
- From: Xiaochun Lu
- Re: [Wireshark-dev] gencode.c
- From: Guy Harris
- [Wireshark-dev] gencode.c
- Prev by Date: Re: [Wireshark-dev] XML Dissection in Wireshark
- Next by Date: Re: [Wireshark-dev] compiling dissector plugin
- Previous by thread: Re: [Wireshark-dev] gencode.c
- Next by thread: [Wireshark-dev] compiling dissector plugin
- Index(es):
- Get Wireshark
- Download
- Code of Conduct