Wireshark-users: Re: [Wireshark-users] arptype 65534 not supported by libpcap - falling back to c
From: Guy Harris <[email protected]>
Date: Mon, 23 Jun 2008 23:48:46 -0700
Toralf Förster wrote:
I'm wondering what I can do to avoid that message which appears if I try to sniff
a VPN connection established at home via DSL using AT & T Global Network 
Client.
Either compile the current top-of-CVS tree version of libpcap, or apply 
the attached patch to whatever version of libpcap you have, build it, 
and install it.
The alternative is to ignore the message (dismiss the dialog box) - the 
capture should happen, and no data should be lost.  If the capture 
*doesn't* happen, file a bug.
Index: pcap-linux.c
===================================================================
RCS file: /tcpdump/master/libpcap/pcap-linux.c,v
retrieving revision 1.148
diff -c -r1.148 pcap-linux.c
*** pcap-linux.c	14 Apr 2008 21:04:51 -0000	1.148
--- pcap-linux.c	24 Jun 2008 06:43:49 -0000
***************
*** 1539,1544 ****
--- 1539,1555 ----
  		handle->linktype = DLT_LINUX_LAPD;
  		break;
  
+ #ifndef ARPHRD_NONE
+ #define ARPHRD_NONE	0xFFFE
+ #endif
+ 	case ARPHRD_NONE:
+ 		/*
+ 		 * No link-layer header; packets are just IP
+ 		 * packets, so use DLT_RAW.
+ 		 */
+ 		handle->linktype = DLT_RAW;
+ 		break;
+ 
  	default:
  		handle->linktype = -1;
  		break;