[netflow-tools] "Unsupported datalink type 113" - patch

[Tony and Robyn Lewis]

Damien Miller wrote:

> On Thu, 17 Nov 2005, Tony and Robyn Lewis wrote:
>
>> Have hacked a bit and got it "working"
>>
>> Added the following to the lt[] table:
>>        { DLT_LINUX_SLL,16, 14,  2,  1, 0xffffffff,  0x0800,   0x86dd },
>>
>> This, after a comparative dump of what comes in.
>>
>> However, it's a messy hack, and i get the feel that cooked sockets are
>> gonna be very variable in these parameters.
>>
>> What's an elegant solution?  Speculations:
>> * have a "is a PPPoE" flag which then uses this definition
>> * have a "--skiplen 16 --ft_off 14 --ft_len 2 (etc etc)" set of flags,
>> or a "--flags=16,14,2,(etc etc)" flags
>> * autodetect? maybe this is how tcpdump knows what to do
>
>
> I think a combination of the second and the third would be the most 
> useful for the general case. tcpdump probably has code we can steal...

I've had more of a look.  According to 
http://oss.coresecurity.com/pcapy/doc/rn02re10.html (manpage for 
datalink() function), the datalink header for DLT_LINUX_SLL is a fixed 
format.  It's always 16 bytes; the frametypes are the same as ethernet, 
and always in the same spot.

So the attached patch should add ppp0 functionality to softflowd.

Tony Lewis


-------------- next part --------------
A non-text attachment was scrubbed...
Name: softflowd.c.DLT_LINUX_SLL.patch
Type: text/x-patch
Size: 513 bytes
Desc: not available
Url : http://lists.mindrot.org/pipermail/netflow-tools/attachments/20051118/f44721a5/attachment.bin