[netflow-tools] "Unsupported datalink type 113" - patch

Tony and Robyn Lewis gnutered at yahoo.com.au
Fri Nov 18 10:29:40 EST 2005

Damien Miller wrote:

> On Thu, 17 Nov 2005, Tony and Robyn Lewis wrote:
>> Have hacked a bit and got it "working"
>> Added the following to the lt[] table:
>>        { DLT_LINUX_SLL,16, 14,  2,  1, 0xffffffff,  0x0800,   0x86dd },
>> This, after a comparative dump of what comes in.
>> However, it's a messy hack, and i get the feel that cooked sockets are
>> gonna be very variable in these parameters.
>> What's an elegant solution?  Speculations:
>> * have a "is a PPPoE" flag which then uses this definition
>> * have a "--skiplen 16 --ft_off 14 --ft_len 2 (etc etc)" set of flags,
>> or a "--flags=16,14,2,(etc etc)" flags
>> * autodetect? maybe this is how tcpdump knows what to do
> I think a combination of the second and the third would be the most 
> useful for the general case. tcpdump probably has code we can steal...

I've had more of a look.  According to 
http://oss.coresecurity.com/pcapy/doc/rn02re10.html (manpage for 
datalink() function), the datalink header for DLT_LINUX_SLL is a fixed 
format.  It's always 16 bytes; the frametypes are the same as ethernet, 
and always in the same spot.

So the attached patch should add ppp0 functionality to softflowd.

Tony Lewis

-------------- next part --------------
A non-text attachment was scrubbed...
Name: softflowd.c.DLT_LINUX_SLL.patch
Type: text/x-patch
Size: 513 bytes
Desc: not available
Url : http://lists.mindrot.org/pipermail/netflow-tools/attachments/20051118/f44721a5/attachment.bin 

More information about the netflow-tools mailing list