[netflow-tools] CISCO HDLC Pcap format

[Damien Miller]

On Wed, 21 Feb 2007, Víctor López Álvarez wrote:

> I have tried to change from Pcap format to Netflow using softflowd but 
> it say me that the format I use is not support. However, I can extract 
> information using tcpdump, so I wonder why  softflowd say me that is an 
> unsupported datalink type.
> 
> Anyone knows which is the reason?

Because support for it has not been implemented.

> Besides, how could I add the support for this header?

Near the start of softflowd.c there is a definition of "struct DATALINK"
and a table of supported datalink types "lt[]". struct DATALINK defines
where in the layer-2 frame softflowd should look for the frame type, how
to extract it and how to interpet it to determine whether a frame represents
a IPv4 or IPv6 packet.

Adding a new frame type to softflowd is as simple as adding an entry to
this array. 

-d