[netflow-tools] "Unsupported datalink type 113"

[Tony and Robyn Lewis]

Tony and Robyn Lewis wrote:

> Moving right along (after using gcc-3.3, not gcc-4)
>
> If I try to run softflowd against my ppp0. I get a datalink error:
>
> me at mymachine:~/softflowd-0.9.7$ sudo ./softflowd -d -D -i ppp0 
> -nlocalhost:2205
> Unsupported datalink type 113
>
> My ppp0 is PPPoE.  In the header file, I see DLT_LINUX_SLL is 113, for 
> "Linux cooked sockets".
>
> At the limit of my knowledge on this, but am I running into grief 
> because it's PPPoE and not pure PPP?  Is there a good fix for this, 
> like can we add a definition for DLT_LINUX_SLL in the lt[] array?
>
> Many thanks for prompt help thusfar :-)

Have hacked a bit and got it "working"

Added the following to the lt[] table:
        { DLT_LINUX_SLL,16, 14,  2,  1, 0xffffffff,  0x0800,   0x86dd },

This, after a comparative dump of what comes in.

However, it's a messy hack, and i get the feel that cooked sockets are 
gonna be very variable in these parameters.

What's an elegant solution?  Speculations:
 * have a "is a PPPoE" flag which then uses this definition
 * have a "--skiplen 16 --ft_off 14 --ft_len 2 (etc etc)" set of flags, 
or a "--flags=16,14,2,(etc etc)" flags
 * autodetect? maybe this is how tcpdump knows what to do

Tony