1 /*- 2 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Some portions Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. 6 * Some portions Copyright (C) 2010-2013 Sourcefire, Inc. 7 * 8 * This code is derived from the Stanford/CMU enet packet filter, 9 * (net/enet.c) distributed as part of 4.3BSD, and code contributed 10 * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence 11 * Berkeley Laboratory. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 3. All advertising materials mentioning features or use of this software 22 * must display the following acknowledgement: 23 * This product includes software developed by the University of 24 * California, Berkeley and its contributors. 25 * 4. Neither the name of the University nor the names of its contributors 26 * may be used to endorse or promote products derived from this software 27 * without specific prior written permission. 28 * 29 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 30 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 31 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 32 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 33 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 34 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 35 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 36 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 37 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 38 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 39 * SUCH DAMAGE. 40 * 41 * @(#)bpf.h 7.1 (Berkeley) 5/7/91 42 * 43 * @(#) $Header: /usr/cvsroot/sfeng/ims/src/libraries/daq/daq/sfbpf/sfbpf_dlt.h,v 1.3 2014/06/10 13:38:55 cwaxman Exp $ (LBL) 44 */ 45 46 /* 47 * This is just the DLT_* definitions as taken from libpcap-1.0.0's bpf.h. 48 */ 49 50 #ifndef _SFBPF_DLT_H 51 #define _SFBPF_DLT_H 52 53 /* 54 * Data-link level type codes. 55 * 56 * Do *NOT* add new values to this list without asking 57 * "[email protected]" for a value. Otherwise, you run 58 * the risk of using a value that's already being used for some other 59 * purpose, and of having tools that read libpcap-format captures not 60 * being able to handle captures with your new DLT_ value, with no hope 61 * that they will ever be changed to do so (as that would destroy their 62 * ability to read captures using that value for that other purpose). 63 */ 64 65 /* 66 * These are the types that are the same on all platforms, and that 67 * have been defined by <net/bpf.h> for ages. 68 */ 69 #define DLT_NULL 0 /* BSD loopback encapsulation */ 70 #define DLT_EN10MB 1 /* Ethernet (10Mb) */ 71 #define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */ 72 #define DLT_AX25 3 /* Amateur Radio AX.25 */ 73 #define DLT_PRONET 4 /* Proteon ProNET Token Ring */ 74 #define DLT_CHAOS 5 /* Chaos */ 75 #define DLT_IEEE802 6 /* 802.5 Token Ring */ 76 #define DLT_ARCNET 7 /* ARCNET, with BSD-style header */ 77 #define DLT_SLIP 8 /* Serial Line IP */ 78 #define DLT_PPP 9 /* Point-to-point Protocol */ 79 #define DLT_FDDI 10 /* FDDI */ 80 81 /* 82 * These are types that are different on some platforms, and that 83 * have been defined by <net/bpf.h> for ages. We use #ifdefs to 84 * detect the BSDs that define them differently from the traditional 85 * libpcap <net/bpf.h> 86 * 87 * XXX - DLT_ATM_RFC1483 is 13 in BSD/OS, and DLT_RAW is 14 in BSD/OS, 88 * but I don't know what the right #define is for BSD/OS. 89 */ 90 #define DLT_ATM_RFC1483 11 /* LLC-encapsulated ATM */ 91 92 #ifdef __OpenBSD__ 93 #define DLT_RAW 14 /* raw IP */ 94 #else 95 #define DLT_RAW 12 /* raw IP */ 96 #endif 97 98 /* 99 * Given that the only OS that currently generates BSD/OS SLIP or PPP 100 * is, well, BSD/OS, arguably everybody should have chosen its values 101 * for DLT_SLIP_BSDOS and DLT_PPP_BSDOS, which are 15 and 16, but they 102 * didn't. So it goes. 103 */ 104 #if defined(__NetBSD__) || defined(__FreeBSD__) 105 #ifndef DLT_SLIP_BSDOS 106 #define DLT_SLIP_BSDOS 13 /* BSD/OS Serial Line IP */ 107 #define DLT_PPP_BSDOS 14 /* BSD/OS Point-to-point Protocol */ 108 #endif 109 #else 110 #define DLT_SLIP_BSDOS 15 /* BSD/OS Serial Line IP */ 111 #define DLT_PPP_BSDOS 16 /* BSD/OS Point-to-point Protocol */ 112 #endif 113 114 /* 115 * 17 is used for DLT_OLD_PFLOG in OpenBSD; 116 * OBSOLETE: DLT_PFLOG is 117 in OpenBSD now as well. See below. 117 * 18 is used for DLT_PFSYNC in OpenBSD; don't use it for anything else. 118 */ 119 120 #define DLT_ATM_CLIP 19 /* Linux Classical-IP over ATM */ 121 122 /* 123 * Apparently Redback uses this for its SmartEdge 400/800. I hope 124 * nobody else decided to use it, too. 125 */ 126 #define DLT_REDBACK_SMARTEDGE 32 127 128 /* 129 * These values are defined by NetBSD; other platforms should refrain from 130 * using them for other purposes, so that NetBSD savefiles with link 131 * types of 50 or 51 can be read as this type on all platforms. 132 */ 133 #define DLT_PPP_SERIAL 50 /* PPP over serial with HDLC encapsulation */ 134 #define DLT_PPP_ETHER 51 /* PPP over Ethernet */ 135 136 /* 137 * The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses 138 * a link-layer type of 99 for the tcpdump it supplies. The link-layer 139 * header has 6 bytes of unknown data, something that appears to be an 140 * Ethernet type, and 36 bytes that appear to be 0 in at least one capture 141 * I've seen. 142 */ 143 #define DLT_SYMANTEC_FIREWALL 99 144 145 /* 146 * Values between 100 and 103 are used in capture file headers as 147 * link-layer types corresponding to DLT_ types that differ 148 * between platforms; don't use those values for new DLT_ new types. 149 */ 150 151 /* 152 * This value was defined by libpcap 0.5; platforms that have defined 153 * it with a different value should define it here with that value - 154 * a link type of 104 in a save file will be mapped to DLT_C_HDLC, 155 * whatever value that happens to be, so programs will correctly 156 * handle files with that link type regardless of the value of 157 * DLT_C_HDLC. 158 * 159 * The name DLT_C_HDLC was used by BSD/OS; we use that name for source 160 * compatibility with programs written for BSD/OS. 161 * 162 * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well, 163 * for source compatibility with programs written for libpcap 0.5. 164 */ 165 #define DLT_C_HDLC 104 /* Cisco HDLC */ 166 #define DLT_CHDLC DLT_C_HDLC 167 168 #define DLT_IEEE802_11 105 /* IEEE 802.11 wireless */ 169 170 /* 171 * 106 is reserved for Linux Classical IP over ATM; it's like DLT_RAW, 172 * except when it isn't. (I.e., sometimes it's just raw IP, and 173 * sometimes it isn't.) We currently handle it as DLT_LINUX_SLL, 174 * so that we don't have to worry about the link-layer header.) 175 */ 176 177 /* 178 * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides 179 * with other values. 180 * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header 181 * (DLCI, etc.). 182 */ 183 #define DLT_FRELAY 107 184 185 /* 186 * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except 187 * that the AF_ type in the link-layer header is in network byte order. 188 * 189 * DLT_LOOP is 12 in OpenBSD, but that's DLT_RAW in other OSes, so 190 * we don't use 12 for it in OSes other than OpenBSD. 191 */ 192 #ifdef __OpenBSD__ 193 #define DLT_LOOP 12 194 #else 195 #define DLT_LOOP 108 196 #endif 197 198 /* 199 * Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's 200 * DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other 201 * than OpenBSD. 202 */ 203 #ifdef __OpenBSD__ 204 #define DLT_ENC 13 205 #else 206 #define DLT_ENC 109 207 #endif 208 209 /* 210 * Values between 110 and 112 are reserved for use in capture file headers 211 * as link-layer types corresponding to DLT_ types that might differ 212 * between platforms; don't use those values for new DLT_ types 213 * other than the corresponding DLT_ types. 214 */ 215 216 /* 217 * This is for Linux cooked sockets. 218 */ 219 #define DLT_LINUX_SLL 113 220 221 /* 222 * Apple LocalTalk hardware. 223 */ 224 #define DLT_LTALK 114 225 226 /* 227 * Acorn Econet. 228 */ 229 #define DLT_ECONET 115 230 231 /* 232 * Reserved for use with OpenBSD ipfilter. 233 */ 234 #define DLT_IPFILTER 116 235 236 /* 237 * OpenBSD DLT_PFLOG; DLT_PFLOG is 17 in OpenBSD, but that's DLT_LANE8023 238 * in SuSE 6.3, so we can't use 17 for it in capture-file headers. 239 * 240 * XXX: is there a conflict with DLT_PFSYNC 18 as well? 241 */ 242 #ifdef __OpenBSD__ 243 #define DLT_OLD_PFLOG 17 244 #define DLT_PFSYNC 18 245 #endif 246 #define DLT_PFLOG 117 247 248 /* 249 * Registered for Cisco-internal use. 250 */ 251 #define DLT_CISCO_IOS 118 252 253 /* 254 * For 802.11 cards using the Prism II chips, with a link-layer 255 * header including Prism monitor mode information plus an 802.11 256 * header. 257 */ 258 #define DLT_PRISM_HEADER 119 259 260 /* 261 * Reserved for Aironet 802.11 cards, with an Aironet link-layer header 262 * (see Doug Ambrisko's FreeBSD patches). 263 */ 264 #define DLT_AIRONET_HEADER 120 265 266 /* 267 * Reserved for Siemens HiPath HDLC. 268 */ 269 #define DLT_HHDLC 121 270 271 /* 272 * This is for RFC 2625 IP-over-Fibre Channel. 273 * 274 * This is not for use with raw Fibre Channel, where the link-layer 275 * header starts with a Fibre Channel frame header; it's for IP-over-FC, 276 * where the link-layer header starts with an RFC 2625 Network_Header 277 * field. 278 */ 279 #define DLT_IP_OVER_FC 122 280 281 /* 282 * This is for Full Frontal ATM on Solaris with SunATM, with a 283 * pseudo-header followed by an AALn PDU. 284 * 285 * There may be other forms of Full Frontal ATM on other OSes, 286 * with different pseudo-headers. 287 * 288 * If ATM software returns a pseudo-header with VPI/VCI information 289 * (and, ideally, packet type information, e.g. signalling, ILMI, 290 * LANE, LLC-multiplexed traffic, etc.), it should not use 291 * DLT_ATM_RFC1483, but should get a new DLT_ value, so tcpdump 292 * and the like don't have to infer the presence or absence of a 293 * pseudo-header and the form of the pseudo-header. 294 */ 295 #define DLT_SUNATM 123 /* Solaris+SunATM */ 296 297 /* 298 * Reserved as per request from Kent Dahlgren <[email protected]> 299 * for private use. 300 */ 301 #define DLT_RIO 124 /* RapidIO */ 302 #define DLT_PCI_EXP 125 /* PCI Express */ 303 #define DLT_AURORA 126 /* Xilinx Aurora link layer */ 304 305 /* 306 * Header for 802.11 plus a number of bits of link-layer information 307 * including radio information, used by some recent BSD drivers as 308 * well as the madwifi Atheros driver for Linux. 309 */ 310 #define DLT_IEEE802_11_RADIO 127 /* 802.11 plus radiotap radio header */ 311 312 /* 313 * Reserved for the TZSP encapsulation, as per request from 314 * Chris Waters <[email protected]> 315 * TZSP is a generic encapsulation for any other link type, 316 * which includes a means to include meta-information 317 * with the packet, e.g. signal strength and channel 318 * for 802.11 packets. 319 */ 320 #define DLT_TZSP 128 /* Tazmen Sniffer Protocol */ 321 322 /* 323 * BSD's ARCNET headers have the source host, destination host, 324 * and type at the beginning of the packet; that's what's handed 325 * up to userland via BPF. 326 * 327 * Linux's ARCNET headers, however, have a 2-byte offset field 328 * between the host IDs and the type; that's what's handed up 329 * to userland via PF_PACKET sockets. 330 * 331 * We therefore have to have separate DLT_ values for them. 332 */ 333 #define DLT_ARCNET_LINUX 129 /* ARCNET */ 334 335 /* 336 * Juniper-private data link types, as per request from 337 * Hannes Gredler <[email protected]>. The DLT_s are used 338 * for passing on chassis-internal metainformation such as 339 * QOS profiles, etc.. 340 */ 341 #define DLT_JUNIPER_MLPPP 130 342 #define DLT_JUNIPER_MLFR 131 343 #define DLT_JUNIPER_ES 132 344 #define DLT_JUNIPER_GGSN 133 345 #define DLT_JUNIPER_MFR 134 346 #define DLT_JUNIPER_ATM2 135 347 #define DLT_JUNIPER_SERVICES 136 348 #define DLT_JUNIPER_ATM1 137 349 350 /* 351 * Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund 352 * <[email protected]>. The header that's presented is an Ethernet-like 353 * header: 354 * 355 * #define FIREWIRE_EUI64_LEN 8 356 * struct firewire_header { 357 * u_char firewire_dhost[FIREWIRE_EUI64_LEN]; 358 * u_char firewire_shost[FIREWIRE_EUI64_LEN]; 359 * u_short firewire_type; 360 * }; 361 * 362 * with "firewire_type" being an Ethernet type value, rather than, 363 * for example, raw GASP frames being handed up. 364 */ 365 #define DLT_APPLE_IP_OVER_IEEE1394 138 366 367 /* 368 * Various SS7 encapsulations, as per a request from Jeff Morriss 369 * <jeff.morriss[AT]ulticom.com> and subsequent discussions. 370 */ 371 #define DLT_MTP2_WITH_PHDR 139 /* pseudo-header with various info, followed by MTP2 */ 372 #define DLT_MTP2 140 /* MTP2, without pseudo-header */ 373 #define DLT_MTP3 141 /* MTP3, without pseudo-header or MTP2 */ 374 #define DLT_SCCP 142 /* SCCP, without pseudo-header or MTP2 or MTP3 */ 375 376 /* 377 * DOCSIS MAC frames. 378 */ 379 #define DLT_DOCSIS 143 380 381 /* 382 * Linux-IrDA packets. Protocol defined at http://www.irda.org. 383 * Those packets include IrLAP headers and above (IrLMP...), but 384 * don't include Phy framing (SOF/EOF/CRC & byte stuffing), because Phy 385 * framing can be handled by the hardware and depend on the bitrate. 386 * This is exactly the format you would get capturing on a Linux-IrDA 387 * interface (irdaX), but not on a raw serial port. 388 * Note the capture is done in "Linux-cooked" mode, so each packet include 389 * a fake packet header (struct sll_header). This is because IrDA packet 390 * decoding is dependant on the direction of the packet (incomming or 391 * outgoing). 392 * When/if other platform implement IrDA capture, we may revisit the 393 * issue and define a real DLT_IRDA... 394 * Jean II 395 */ 396 #define DLT_LINUX_IRDA 144 397 398 /* 399 * Reserved for IBM SP switch and IBM Next Federation switch. 400 */ 401 #define DLT_IBM_SP 145 402 #define DLT_IBM_SN 146 403 404 /* 405 * Reserved for private use. If you have some link-layer header type 406 * that you want to use within your organization, with the capture files 407 * using that link-layer header type not ever be sent outside your 408 * organization, you can use these values. 409 * 410 * No libpcap release will use these for any purpose, nor will any 411 * tcpdump release use them, either. 412 * 413 * Do *NOT* use these in capture files that you expect anybody not using 414 * your private versions of capture-file-reading tools to read; in 415 * particular, do *NOT* use them in products, otherwise you may find that 416 * people won't be able to use tcpdump, or snort, or Ethereal, or... to 417 * read capture files from your firewall/intrusion detection/traffic 418 * monitoring/etc. appliance, or whatever product uses that DLT_ value, 419 * and you may also find that the developers of those applications will 420 * not accept patches to let them read those files. 421 * 422 * Also, do not use them if somebody might send you a capture using them 423 * for *their* private type and tools using them for *your* private type 424 * would have to read them. 425 * 426 * Instead, ask "[email protected]" for a new DLT_ value, 427 * as per the comment above, and use the type you're given. 428 */ 429 #define DLT_USER0 147 430 #define DLT_USER1 148 431 #define DLT_USER2 149 432 #define DLT_USER3 150 433 #define DLT_USER4 151 434 #define DLT_USER5 152 435 #define DLT_USER6 153 436 #define DLT_USER7 154 437 #define DLT_USER8 155 438 #define DLT_USER9 156 439 #define DLT_USER10 157 440 #define DLT_USER11 158 441 #define DLT_USER12 159 442 #define DLT_USER13 160 443 #define DLT_USER14 161 444 #define DLT_USER15 162 445 446 /* 447 * For future use with 802.11 captures - defined by AbsoluteValue 448 * Systems to store a number of bits of link-layer information 449 * including radio information: 450 * 451 * http://www.shaftnet.org/~pizza/software/capturefrm.txt 452 * 453 * but it might be used by some non-AVS drivers now or in the 454 * future. 455 */ 456 #define DLT_IEEE802_11_RADIO_AVS 163 /* 802.11 plus AVS radio header */ 457 458 /* 459 * Juniper-private data link type, as per request from 460 * Hannes Gredler <[email protected]>. The DLT_s are used 461 * for passing on chassis-internal metainformation such as 462 * QOS profiles, etc.. 463 */ 464 #define DLT_JUNIPER_MONITOR 164 465 466 /* 467 * Reserved for BACnet MS/TP. 468 */ 469 #define DLT_BACNET_MS_TP 165 470 471 /* 472 * Another PPP variant as per request from Karsten Keil <[email protected]>. 473 * 474 * This is used in some OSes to allow a kernel socket filter to distinguish 475 * between incoming and outgoing packets, on a socket intended to 476 * supply pppd with outgoing packets so it can do dial-on-demand and 477 * hangup-on-lack-of-demand; incoming packets are filtered out so they 478 * don't cause pppd to hold the connection up (you don't want random 479 * input packets such as port scans, packets from old lost connections, 480 * etc. to force the connection to stay up). 481 * 482 * The first byte of the PPP header (0xff03) is modified to accomodate 483 * the direction - 0x00 = IN, 0x01 = OUT. 484 */ 485 #define DLT_PPP_PPPD 166 486 487 /* 488 * Names for backwards compatibility with older versions of some PPP 489 * software; new software should use DLT_PPP_PPPD. 490 */ 491 #define DLT_PPP_WITH_DIRECTION DLT_PPP_PPPD 492 #define DLT_LINUX_PPP_WITHDIRECTION DLT_PPP_PPPD 493 494 /* 495 * Juniper-private data link type, as per request from 496 * Hannes Gredler <[email protected]>. The DLT_s are used 497 * for passing on chassis-internal metainformation such as 498 * QOS profiles, cookies, etc.. 499 */ 500 #define DLT_JUNIPER_PPPOE 167 501 #define DLT_JUNIPER_PPPOE_ATM 168 502 503 #define DLT_GPRS_LLC 169 /* GPRS LLC */ 504 #define DLT_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */ 505 #define DLT_GPF_F 171 /* GPF-F (ITU-T G.7041/Y.1303) */ 506 507 /* 508 * Requested by Oolan Zimmer <[email protected]> for use in Gcom's T1/E1 line 509 * monitoring equipment. 510 */ 511 #define DLT_GCOM_T1E1 172 512 #define DLT_GCOM_SERIAL 173 513 514 /* 515 * Juniper-private data link type, as per request from 516 * Hannes Gredler <[email protected]>. The DLT_ is used 517 * for internal communication to Physical Interface Cards (PIC) 518 */ 519 #define DLT_JUNIPER_PIC_PEER 174 520 521 /* 522 * Link types requested by Gregor Maier <[email protected]> of Endace 523 * Measurement Systems. They add an ERF header (see 524 * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of 525 * the link-layer header. 526 */ 527 #define DLT_ERF_ETH 175 /* Ethernet */ 528 #define DLT_ERF_POS 176 /* Packet-over-SONET */ 529 530 /* 531 * Requested by Daniele Orlandi <[email protected]> for raw LAPD 532 * for vISDN (http://www.orlandi.com/visdn/). Its link-layer header 533 * includes additional information before the LAPD header, so it's 534 * not necessarily a generic LAPD header. 535 */ 536 #define DLT_LINUX_LAPD 177 537 538 /* 539 * Juniper-private data link type, as per request from 540 * Hannes Gredler <[email protected]>. 541 * The DLT_ are used for prepending meta-information 542 * like interface index, interface name 543 * before standard Ethernet, PPP, Frelay & C-HDLC Frames 544 */ 545 #define DLT_JUNIPER_ETHER 178 546 #define DLT_JUNIPER_PPP 179 547 #define DLT_JUNIPER_FRELAY 180 548 #define DLT_JUNIPER_CHDLC 181 549 550 /* 551 * Multi Link Frame Relay (FRF.16) 552 */ 553 #define DLT_MFR 182 554 555 /* 556 * Juniper-private data link type, as per request from 557 * Hannes Gredler <[email protected]>. 558 * The DLT_ is used for internal communication with a 559 * voice Adapter Card (PIC) 560 */ 561 #define DLT_JUNIPER_VP 183 562 563 /* 564 * Arinc 429 frames. 565 * DLT_ requested by Gianluca Varenni <[email protected]>. 566 * Every frame contains a 32bit A429 label. 567 * More documentation on Arinc 429 can be found at 568 * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf 569 */ 570 #define DLT_A429 184 571 572 /* 573 * Arinc 653 Interpartition Communication messages. 574 * DLT_ requested by Gianluca Varenni <[email protected]>. 575 * Please refer to the A653-1 standard for more information. 576 */ 577 #define DLT_A653_ICM 185 578 579 /* 580 * USB packets, beginning with a USB setup header; requested by 581 * Paolo Abeni <[email protected]>. 582 */ 583 #define DLT_USB 186 584 585 /* 586 * Bluetooth HCI UART transport layer (part H:4); requested by 587 * Paolo Abeni. 588 */ 589 #define DLT_BLUETOOTH_HCI_H4 187 590 591 /* 592 * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz 593 * <[email protected]>. 594 */ 595 #define DLT_IEEE802_16_MAC_CPS 188 596 597 /* 598 * USB packets, beginning with a Linux USB header; requested by 599 * Paolo Abeni <[email protected]>. 600 */ 601 #define DLT_USB_LINUX 189 602 603 /* 604 * Controller Area Network (CAN) v. 2.0B packets. 605 * DLT_ requested by Gianluca Varenni <[email protected]>. 606 * Used to dump CAN packets coming from a CAN Vector board. 607 * More documentation on the CAN v2.0B frames can be found at 608 * http://www.can-cia.org/downloads/?269 609 */ 610 #define DLT_CAN20B 190 611 612 /* 613 * IEEE 802.15.4, with address fields padded, as is done by Linux 614 * drivers; requested by Juergen Schimmer. 615 */ 616 #define DLT_IEEE802_15_4_LINUX 191 617 618 /* 619 * Per Packet Information encapsulated packets. 620 * DLT_ requested by Gianluca Varenni <[email protected]>. 621 */ 622 #define DLT_PPI 192 623 624 /* 625 * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header; 626 * requested by Charles Clancy. 627 */ 628 #define DLT_IEEE802_16_MAC_CPS_RADIO 193 629 630 /* 631 * Juniper-private data link type, as per request from 632 * Hannes Gredler <[email protected]>. 633 * The DLT_ is used for internal communication with a 634 * integrated service module (ISM). 635 */ 636 #define DLT_JUNIPER_ISM 194 637 638 /* 639 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 640 * nothing); requested by Mikko Saarnivala <[email protected]>. 641 */ 642 #define DLT_IEEE802_15_4 195 643 644 /* 645 * Various link-layer types, with a pseudo-header, for SITA 646 * (http://www.sita.aero/); requested by Fulko Hew ([email protected]). 647 */ 648 #define DLT_SITA 196 649 650 /* 651 * Various link-layer types, with a pseudo-header, for Endace DAG cards; 652 * encapsulates Endace ERF records. Requested by Stephen Donnelly 653 * <[email protected]>. 654 */ 655 #define DLT_ERF 197 656 657 /* 658 * Special header prepended to Ethernet packets when capturing from a 659 * u10 Networks board. Requested by Phil Mulholland 660 * <[email protected]>. 661 */ 662 #define DLT_RAIF1 198 663 664 /* 665 * IPMB packet for IPMI, beginning with the I2C slave address, followed 666 * by the netFn and LUN, etc.. Requested by Chanthy Toeung 667 * <[email protected]>. 668 */ 669 #define DLT_IPMB 199 670 671 /* 672 * Juniper-private data link type, as per request from 673 * Hannes Gredler <[email protected]>. 674 * The DLT_ is used for capturing data on a secure tunnel interface. 675 */ 676 #define DLT_JUNIPER_ST 200 677 678 /* 679 * Bluetooth HCI UART transport layer (part H:4), with pseudo-header 680 * that includes direction information; requested by Paolo Abeni. 681 */ 682 #define DLT_BLUETOOTH_HCI_H4_WITH_PHDR 201 683 684 /* 685 * AX.25 packet with a 1-byte KISS header; see 686 * 687 * http://www.ax25.net/kiss.htm 688 * 689 * as per Richard Stearn <[email protected]>. 690 */ 691 #define DLT_AX25_KISS 202 692 693 /* 694 * LAPD packets from an ISDN channel, starting with the address field, 695 * with no pseudo-header. 696 * Requested by Varuna De Silva <[email protected]>. 697 */ 698 #define DLT_LAPD 203 699 700 /* 701 * Variants of various link-layer headers, with a one-byte direction 702 * pseudo-header prepended - zero means "received by this host", 703 * non-zero (any non-zero value) means "sent by this host" - as per 704 * Will Barker <[email protected]>. 705 */ 706 #define DLT_PPP_WITH_DIR 204 /* PPP - don't confuse with DLT_PPP_WITH_DIRECTION */ 707 #define DLT_C_HDLC_WITH_DIR 205 /* Cisco HDLC */ 708 #define DLT_FRELAY_WITH_DIR 206 /* Frame Relay */ 709 #define DLT_LAPB_WITH_DIR 207 /* LAPB */ 710 711 /* 712 * 208 is reserved for an as-yet-unspecified proprietary link-layer 713 * type, as requested by Will Barker. 714 */ 715 716 /* 717 * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman 718 * <[email protected]>. 719 */ 720 #define DLT_IPMB_LINUX 209 721 722 /* 723 * FlexRay automotive bus - http://www.flexray.com/ - as requested 724 * by Hannes Kaelber <[email protected]>. 725 */ 726 #define DLT_FLEXRAY 210 727 728 /* 729 * Media Oriented Systems Transport (MOST) bus for multimedia 730 * transport - http://www.mostcooperation.com/ - as requested 731 * by Hannes Kaelber <[email protected]>. 732 */ 733 #define DLT_MOST 211 734 735 /* 736 * Local Interconnect Network (LIN) bus for vehicle networks - 737 * http://www.lin-subbus.org/ - as requested by Hannes Kaelber 738 * <[email protected]>. 739 */ 740 #define DLT_LIN 212 741 742 /* 743 * X2E-private data link type used for serial line capture, 744 * as requested by Hannes Kaelber <[email protected]>. 745 */ 746 #define DLT_X2E_SERIAL 213 747 748 /* 749 * X2E-private data link type used for the Xoraya data logger 750 * family, as requested by Hannes Kaelber <[email protected]>. 751 */ 752 #define DLT_X2E_XORAYA 214 753 754 /* 755 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no 756 * nothing), but with the PHY-level data for non-ASK PHYs (4 octets 757 * of 0 as preamble, one octet of SFD, one octet of frame length+ 758 * reserved bit, and then the MAC-layer data, starting with the 759 * frame control field). 760 * 761 * Requested by Max Filippov <[email protected]>. 762 */ 763 #define DLT_IEEE802_15_4_NONASK_PHY 215 764 765 /* 766 * David Gibson <[email protected]> requested this for 767 * captures from the Linux kernel /dev/input/eventN devices. This 768 * is used to communicate keystrokes and mouse movements from the 769 * Linux kernel to display systems, such as Xorg. 770 */ 771 #define DLT_LINUX_EVDEV 216 772 773 /* 774 * GSM Um and Abis interfaces, preceded by a "gsmtap" header. 775 * 776 * Requested by Harald Welte <[email protected]>. 777 */ 778 #define DLT_GSMTAP_UM 217 779 #define DLT_GSMTAP_ABIS 218 780 781 /* 782 * MPLS, with an MPLS label as the link-layer header. 783 * Requested by Michele Marchetto <[email protected]> on behalf 784 * of OpenBSD. 785 */ 786 #define DLT_MPLS 219 787 788 /* 789 * USB packets, beginning with a Linux USB header, with the USB header 790 * padded to 64 bytes; required for memory-mapped access. 791 */ 792 #define DLT_USB_LINUX_MMAPPED 220 793 794 /* 795 * DECT packets, with a pseudo-header; requested by 796 * Matthias Wenzel <[email protected]>. 797 */ 798 #define DLT_DECT 221 799 800 /* 801 * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <[email protected]> 802 * Date: Mon, 11 May 2009 11:18:30 -0500 803 * 804 * DLT_AOS. We need it for AOS Space Data Link Protocol. 805 * I have already written dissectors for but need an OK from 806 * legal before I can submit a patch. 807 * 808 */ 809 #define DLT_AOS 222 810 811 /* 812 * Wireless HART (Highway Addressable Remote Transducer) 813 * From the HART Communication Foundation 814 * IES/PAS 62591 815 * 816 * Requested by Sam Roberts <[email protected]>. 817 */ 818 #define DLT_WIHART 223 819 820 /* 821 * Fibre Channel FC-2 frames, beginning with a Frame_Header. 822 * Requested by Kahou Lei <[email protected]>. 823 */ 824 #define DLT_FC_2 224 825 826 /* 827 * Fibre Channel FC-2 frames, beginning with an encoding of the 828 * SOF, and ending with an encoding of the EOF. 829 * 830 * The encodings represent the frame delimiters as 4-byte sequences 831 * representing the corresponding ordered sets, with K28.5 832 * represented as 0xBC, and the D symbols as the corresponding 833 * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2, 834 * is represented as 0xBC 0xB5 0x55 0x55. 835 * 836 * Requested by Kahou Lei <[email protected]>. 837 */ 838 #define DLT_FC_2_WITH_FRAME_DELIMS 225 839 840 /* 841 * Solaris ipnet pseudo-header; requested by Darren Reed <[email protected]>. 842 * 843 * The pseudo-header starts with a one-byte version number; for version 2, 844 * the pseudo-header is: 845 * 846 * struct dl_ipnetinfo { 847 * u_int8_t dli_version; 848 * u_int8_t dli_family; 849 * u_int16_t dli_htype; 850 * u_int32_t dli_pktlen; 851 * u_int32_t dli_ifindex; 852 * u_int32_t dli_grifindex; 853 * u_int32_t dli_zsrc; 854 * u_int32_t dli_zdst; 855 * }; 856 * 857 * dli_version is 2 for the current version of the pseudo-header. 858 * 859 * dli_family is a Solaris address family value, so it's 2 for IPv4 860 * and 26 for IPv6. 861 * 862 * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing 863 * packets, and 2 for packets arriving from another zone on the same 864 * machine. 865 * 866 * dli_pktlen is the length of the packet data following the pseudo-header 867 * (so the captured length minus dli_pktlen is the length of the 868 * pseudo-header, assuming the entire pseudo-header was captured). 869 * 870 * dli_ifindex is the interface index of the interface on which the 871 * packet arrived. 872 * 873 * dli_grifindex is the group interface index number (for IPMP interfaces). 874 * 875 * dli_zsrc is the zone identifier for the source of the packet. 876 * 877 * dli_zdst is the zone identifier for the destination of the packet. 878 * 879 * A zone number of 0 is the global zone; a zone number of 0xffffffff 880 * means that the packet arrived from another host on the network, not 881 * from another zone on the same machine. 882 * 883 * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates 884 * which of those it is. 885 */ 886 #define DLT_IPNET 226 887 888 /* 889 * CAN (Controller Area Network) frames, with a pseudo-header as supplied 890 * by Linux SocketCAN. See Documentation/networking/can.txt in the Linux 891 * source. 892 * 893 * Requested by Felix Obenhuber <[email protected]>. 894 */ 895 #define DLT_CAN_SOCKETCAN 227 896 897 /* 898 * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies 899 * whether it's v4 or v6. Requested by Darren Reed <[email protected]>. 900 */ 901 #define DLT_IPV4 228 902 #define DLT_IPV6 229 903 904 /* 905 * DLT and savefile link type values are split into a class and 906 * a member of that class. A class value of 0 indicates a regular 907 * DLT_/LINKTYPE_ value. 908 */ 909 #define DLT_CLASS(x) ((x) & 0x03ff0000) 910 911 /* 912 * NetBSD-specific generic "raw" link type. The class value indicates 913 * that this is the generic raw type, and the lower 16 bits are the 914 * address family we're dealing with. Those values are NetBSD-specific; 915 * do not assume that they correspond to AF_ values for your operating 916 * system. 917 */ 918 #define DLT_CLASS_NETBSD_RAWAF 0x02240000 919 #define DLT_NETBSD_RAWAF(af) (DLT_CLASS_NETBSD_RAWAF | (af)) 920 #define DLT_NETBSD_RAWAF_AF(x) ((x) & 0x0000ffff) 921 #define DLT_IS_NETBSD_RAWAF(x) (DLT_CLASS(x) == DLT_CLASS_NETBSD_RAWAF) 922 923 #endif /* _SFBPF_DLT_H */ 924