| 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364 |
- The following instructions apply if you have a Linux platform and want
- libpcap to support the 'ACN' WAN/LAN router product from SITA
- (http://www.sita.aero)
- This might also work on non-Linux Unix-compatible platforms, but that
- has not been tested.
- See also the libpcap INSTALL.txt file for further libpcap configuration
- options.
- These additions/extensions have been made to PCAP to allow it to
- capture packets from a SITA ACN device (and potentially others).
- To enable its support you need to ensure that the distribution has
- a correct configure.ac file; that can be created if neccessay by
- using the normal autoconf procedure of:
- aclocal
- autoconf
- autoheader
- automake
- Then run configure with the 'sita' option:
- ./configure --with-sita
- Applications built with libpcap configured in this way will only detect SITA
- ACN interfaces and will not capture from the native OS packet stream.
- The SITA extension provides a remote datascope operation for capturing
- both WAN and LAN protocols. It effectively splits the operation of
- PCAP into two halves. The top layer performs the majority of the
- work, but interfaces via a TCP session to remote agents that
- provide the lower layer functionality of actual sniffing and
- filtering. More detailed information regarding the functions and
- inter-device protocol and naming conventions are described in detail
- in 'pcap-sita.html'.
- pcap_findalldevs() reads the local system's /etc/hosts file looking
- for host names that match the format of IOP type devices. ie. aaa_I_x_y
- and then queries each associated IP address for a list of its WAN and
- LAN devices. The local system the aggregates the lists obtained from
- each IOP, sorts it, and provides it (to Wireshark et.al) as the
- list of monitorable interfaces.
- Once a valid interface has been selected, pcap_open() is called
- which opens a TCP session (to a well known port) on the target IOP
- and tells it to start monitoring.
- All captured packets are then forwarded across that TCP session
- back to the local 'top layer' for forwarding to the actual
- sniffing program (wireshark...)
- Note that the DLT_SITA link-layer type includes a proprietary header
- that is documented as part of the SITA dissector of Wireshark and is
- also described in 'pcap-sita.html' for posterity sake.
- That header provides:
- - Packet direction (in/out) (1 octet)
- - Link layer hardware signal status (1 octet)
- - Transmit/Receive error status (2 octets)
- - Encapsulated WAN protocol ID (1 octet)
|
