[netflow-tools] CISCO HDLC Pcap format
djm at mindrot.org
Thu Mar 29 15:08:23 EST 2007
On Wed, 21 Feb 2007, Víctor López Álvarez wrote:
> I have tried to change from Pcap format to Netflow using softflowd but
> it say me that the format I use is not support. However, I can extract
> information using tcpdump, so I wonder why softflowd say me that is an
> unsupported datalink type.
> Anyone knows which is the reason?
Because support for it has not been implemented.
> Besides, how could I add the support for this header?
Near the start of softflowd.c there is a definition of "struct DATALINK"
and a table of supported datalink types "lt". struct DATALINK defines
where in the layer-2 frame softflowd should look for the frame type, how
to extract it and how to interpet it to determine whether a frame represents
a IPv4 or IPv6 packet.
Adding a new frame type to softflowd is as simple as adding an entry to
More information about the netflow-tools