bpf.h.html 30 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960
  1. <?xml version='1.0' encoding='iso-8859-1'?>
  2. <!doctype html public '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'>
  3. <html xmlns='http://www.w3c.org/1999/xhtml' lang='en-us'>
  4. <head>
  5. <title>
  6. bpf.h
  7. </title>
  8. <meta http-equiv='content-type' content='text/html;iso-8859-1'/>
  9. <meta name='generator' content='motley-tools 1.9.4 13:40:33 Feb 18 2015'/>
  10. <meta name='author' content='cmaier@cmassoc.net'/>
  11. <meta name='robots' content='noindex,nofollow'/>
  12. <link href='toolkit.css' rel='stylesheet' type='text/css'/>
  13. </head>
  14. <body>
  15. <div class='headerlink'>
  16. [<a href='bluetooth.h.html' title=' bluetooth.h '>PREV</a>]
  17. [<a href='toolkit.html' title=' Index '>HOME</a>]
  18. [<a href='channel.h.html' title=' channel.h '>NEXT</a>]
  19. </div>
  20. <pre>
  21. /*-
  22. * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
  23. * The Regents of the University of California. All rights reserved.
  24. *
  25. * This code is derived from the Stanford/CMU enet packet filter,
  26. * (net/enet.c) distributed as part of 4.3BSD, and code contributed
  27. * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
  28. * Berkeley Laboratory.
  29. *
  30. * Redistribution and use in source and binary forms, with or without
  31. * modification, are permitted provided that the following conditions
  32. * are met:
  33. * 1. Redistributions of source code must retain the above copyright
  34. * notice, this list of conditions and the following disclaimer.
  35. * 2. Redistributions in binary form must reproduce the above copyright
  36. * notice, this list of conditions and the following disclaimer in the
  37. * documentation and/or other materials provided with the distribution.
  38. * 3. All advertising materials mentioning features or use of this software
  39. * must display the following acknowledgement:
  40. * This product includes software developed by the University of
  41. * California, Berkeley and its contributors.
  42. * 4. Neither the name of the University nor the names of its contributors
  43. * may be used to endorse or promote products derived from this software
  44. * without specific prior written permission.
  45. *
  46. * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  47. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  48. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  49. * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  50. * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  51. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  52. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  53. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  54. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  55. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  56. * SUCH DAMAGE.
  57. *
  58. * @(#)bpf.h 7.1 (Berkeley) 5/7/91
  59. *
  60. * @(#) $Header: /tcpdump/master/libpcap/pcap/bpf.h,v 1.19.2.8 2008-09-22 20:16:01 guy Exp $ (LBL)
  61. */
  62. /*
  63. * This is libpcap's cut-down version of bpf.h; it includes only
  64. * the stuff needed for the code generator and the userland BPF
  65. * interpreter, and the libpcap APIs for setting filters, etc..
  66. *
  67. * &quot;pcap-bpf.c&quot; will include the native OS version, as it deals with
  68. * the OS's BPF implementation.
  69. *
  70. * XXX - should this all just be moved to &quot;pcap.h&quot;?
  71. */
  72. #ifndef BPF_MAJOR_VERSION
  73. #ifdef __cplusplus
  74. extern &quot;C&quot; {
  75. #endif
  76. /* BSD style release date */
  77. #define BPF_RELEASE 199606
  78. #ifdef MSDOS /* must be 32-bit */
  79. typedef long bpf_int32;
  80. typedef unsigned long bpf_u_int32;
  81. #else
  82. typedef int bpf_int32;
  83. typedef u_int bpf_u_int32;
  84. #endif
  85. /*
  86. * Alignment macros. BPF_WORDALIGN rounds up to the next
  87. * even multiple of BPF_ALIGNMENT.
  88. */
  89. #ifndef __NetBSD__
  90. #define BPF_ALIGNMENT sizeof(bpf_int32)
  91. #else
  92. #define BPF_ALIGNMENT sizeof(long)
  93. #endif
  94. #define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&amp;~(BPF_ALIGNMENT-1))
  95. #define BPF_MAXBUFSIZE 0x8000
  96. #define BPF_MINBUFSIZE 32
  97. /*
  98. * Structure for &quot;pcap_compile()&quot;, &quot;pcap_setfilter()&quot;, etc..
  99. */
  100. struct bpf_program {
  101. u_int bf_len;
  102. struct bpf_insn *bf_insns;
  103. };
  104. /*
  105. * Struct return by BIOCVERSION. This represents the version number of
  106. * the filter language described by the instruction encodings below.
  107. * bpf understands a program iff kernel_major == filter_major &amp;&amp;
  108. * kernel_minor &gt;= filter_minor, that is, if the value returned by the
  109. * running kernel has the same major number and a minor number equal
  110. * equal to or less than the filter being downloaded. Otherwise, the
  111. * results are undefined, meaning an error may be returned or packets
  112. * may be accepted haphazardly.
  113. * It has nothing to do with the source code version.
  114. */
  115. struct bpf_version {
  116. u_short bv_major;
  117. u_short bv_minor;
  118. };
  119. /* Current version number of filter architecture. */
  120. #define BPF_MAJOR_VERSION 1
  121. #define BPF_MINOR_VERSION 1
  122. /*
  123. * Data-link level type codes.
  124. *
  125. * Do *NOT* add new values to this list without asking
  126. * &quot;tcpdump-workers@lists.tcpdump.org&quot; for a value. Otherwise, you run
  127. * the risk of using a value that's already being used for some other
  128. * purpose, and of having tools that read libpcap-format captures not
  129. * being able to handle captures with your new DLT_ value, with no hope
  130. * that they will ever be changed to do so (as that would destroy their
  131. * ability to read captures using that value for that other purpose).
  132. */
  133. /*
  134. * These are the types that are the same on all platforms, and that
  135. * have been defined by &lt;net/bpf.h&gt; for ages.
  136. */
  137. #define DLT_NULL 0 /* BSD loopback encapsulation */
  138. #define DLT_EN10MB 1 /* Ethernet (10Mb) */
  139. #define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */
  140. #define DLT_AX25 3 /* Amateur Radio AX.25 */
  141. #define DLT_PRONET 4 /* Proteon ProNET Token Ring */
  142. #define DLT_CHAOS 5 /* Chaos */
  143. #define DLT_IEEE802 6 /* 802.5 Token Ring */
  144. #define DLT_ARCNET 7 /* ARCNET, with BSD-style header */
  145. #define DLT_SLIP 8 /* Serial Line IP */
  146. #define DLT_PPP 9 /* Point-to-point Protocol */
  147. #define DLT_FDDI 10 /* FDDI */
  148. /*
  149. * These are types that are different on some platforms, and that
  150. * have been defined by &lt;net/bpf.h&gt; for ages. We use #ifdefs to
  151. * detect the BSDs that define them differently from the traditional
  152. * libpcap &lt;net/bpf.h&gt;
  153. *
  154. * XXX - DLT_ATM_RFC1483 is 13 in BSD/OS, and DLT_RAW is 14 in BSD/OS,
  155. * but I don't know what the right #define is for BSD/OS.
  156. */
  157. #define DLT_ATM_RFC1483 11 /* LLC-encapsulated ATM */
  158. #ifdef __OpenBSD__
  159. #define DLT_RAW 14 /* raw IP */
  160. #else
  161. #define DLT_RAW 12 /* raw IP */
  162. #endif
  163. /*
  164. * Given that the only OS that currently generates BSD/OS SLIP or PPP
  165. * is, well, BSD/OS, arguably everybody should have chosen its values
  166. * for DLT_SLIP_BSDOS and DLT_PPP_BSDOS, which are 15 and 16, but they
  167. * didn't. So it goes.
  168. */
  169. #if defined(__NetBSD__) || defined(__FreeBSD__)
  170. #ifndef DLT_SLIP_BSDOS
  171. #define DLT_SLIP_BSDOS 13 /* BSD/OS Serial Line IP */
  172. #define DLT_PPP_BSDOS 14 /* BSD/OS Point-to-point Protocol */
  173. #endif
  174. #else
  175. #define DLT_SLIP_BSDOS 15 /* BSD/OS Serial Line IP */
  176. #define DLT_PPP_BSDOS 16 /* BSD/OS Point-to-point Protocol */
  177. #endif
  178. /*
  179. * 17 is used for DLT_OLD_PFLOG in OpenBSD;
  180. * OBSOLETE: DLT_PFLOG is 117 in OpenBSD now as well. See below.
  181. * 18 is used for DLT_PFSYNC in OpenBSD; don't use it for anything else.
  182. */
  183. #define DLT_ATM_CLIP 19 /* Linux Classical-IP over ATM */
  184. /*
  185. * Apparently Redback uses this for its SmartEdge 400/800. I hope
  186. * nobody else decided to use it, too.
  187. */
  188. #define DLT_REDBACK_SMARTEDGE 32
  189. /*
  190. * These values are defined by NetBSD; other platforms should refrain from
  191. * using them for other purposes, so that NetBSD savefiles with link
  192. * types of 50 or 51 can be read as this type on all platforms.
  193. */
  194. #define DLT_PPP_SERIAL 50 /* PPP over serial with HDLC encapsulation */
  195. #define DLT_PPP_ETHER 51 /* PPP over Ethernet */
  196. /*
  197. * The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses
  198. * a link-layer type of 99 for the tcpdump it supplies. The link-layer
  199. * header has 6 bytes of unknown data, something that appears to be an
  200. * Ethernet type, and 36 bytes that appear to be 0 in at least one capture
  201. * I've seen.
  202. */
  203. #define DLT_SYMANTEC_FIREWALL 99
  204. /*
  205. * Values between 100 and 103 are used in capture file headers as
  206. * link-layer types corresponding to DLT_ types that differ
  207. * between platforms; don't use those values for new DLT_ new types.
  208. */
  209. /*
  210. * This value was defined by libpcap 0.5; platforms that have defined
  211. * it with a different value should define it here with that value -
  212. * a link type of 104 in a save file will be mapped to DLT_C_HDLC,
  213. * whatever value that happens to be, so programs will correctly
  214. * handle files with that link type regardless of the value of
  215. * DLT_C_HDLC.
  216. *
  217. * The name DLT_C_HDLC was used by BSD/OS; we use that name for source
  218. * compatibility with programs written for BSD/OS.
  219. *
  220. * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
  221. * for source compatibility with programs written for libpcap 0.5.
  222. */
  223. #define DLT_C_HDLC 104 /* Cisco HDLC */
  224. #define DLT_CHDLC DLT_C_HDLC
  225. #define DLT_IEEE802_11 105 /* IEEE 802.11 wireless */
  226. /*
  227. * 106 is reserved for Linux Classical IP over ATM; it's like DLT_RAW,
  228. * except when it isn't. (I.e., sometimes it's just raw IP, and
  229. * sometimes it isn't.) We currently handle it as DLT_LINUX_SLL,
  230. * so that we don't have to worry about the link-layer header.)
  231. */
  232. /*
  233. * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides
  234. * with other values.
  235. * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header
  236. * (DLCI, etc.).
  237. */
  238. #define DLT_FRELAY 107
  239. /*
  240. * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
  241. * that the AF_ type in the link-layer header is in network byte order.
  242. *
  243. * DLT_LOOP is 12 in OpenBSD, but that's DLT_RAW in other OSes, so
  244. * we don't use 12 for it in OSes other than OpenBSD.
  245. */
  246. #ifdef __OpenBSD__
  247. #define DLT_LOOP 12
  248. #else
  249. #define DLT_LOOP 108
  250. #endif
  251. /*
  252. * Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's
  253. * DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other
  254. * than OpenBSD.
  255. */
  256. #ifdef __OpenBSD__
  257. #define DLT_ENC 13
  258. #else
  259. #define DLT_ENC 109
  260. #endif
  261. /*
  262. * Values between 110 and 112 are reserved for use in capture file headers
  263. * as link-layer types corresponding to DLT_ types that might differ
  264. * between platforms; don't use those values for new DLT_ types
  265. * other than the corresponding DLT_ types.
  266. */
  267. /*
  268. * This is for Linux cooked sockets.
  269. */
  270. #define DLT_LINUX_SLL 113
  271. /*
  272. * Apple LocalTalk hardware.
  273. */
  274. #define DLT_LTALK 114
  275. /*
  276. * Acorn Econet.
  277. */
  278. #define DLT_ECONET 115
  279. /*
  280. * Reserved for use with OpenBSD ipfilter.
  281. */
  282. #define DLT_IPFILTER 116
  283. /*
  284. * OpenBSD DLT_PFLOG; DLT_PFLOG is 17 in OpenBSD, but that's DLT_LANE8023
  285. * in SuSE 6.3, so we can't use 17 for it in capture-file headers.
  286. *
  287. * XXX: is there a conflict with DLT_PFSYNC 18 as well?
  288. */
  289. #ifdef __OpenBSD__
  290. #define DLT_OLD_PFLOG 17
  291. #define DLT_PFSYNC 18
  292. #endif
  293. #define DLT_PFLOG 117
  294. /*
  295. * Registered for Cisco-internal use.
  296. */
  297. #define DLT_CISCO_IOS 118
  298. /*
  299. * For 802.11 cards using the Prism II chips, with a link-layer
  300. * header including Prism monitor mode information plus an 802.11
  301. * header.
  302. */
  303. #define DLT_PRISM_HEADER 119
  304. /*
  305. * Reserved for Aironet 802.11 cards, with an Aironet link-layer header
  306. * (see Doug Ambrisko's FreeBSD patches).
  307. */
  308. #define DLT_AIRONET_HEADER 120
  309. /*
  310. * Reserved for Siemens HiPath HDLC.
  311. */
  312. #define DLT_HHDLC 121
  313. /*
  314. * This is for RFC 2625 IP-over-Fibre Channel.
  315. *
  316. * This is not for use with raw Fibre Channel, where the link-layer
  317. * header starts with a Fibre Channel frame header; it's for IP-over-FC,
  318. * where the link-layer header starts with an RFC 2625 Network_Header
  319. * field.
  320. */
  321. #define DLT_IP_OVER_FC 122
  322. /*
  323. * This is for Full Frontal ATM on Solaris with SunATM, with a
  324. * pseudo-header followed by an AALn PDU.
  325. *
  326. * There may be other forms of Full Frontal ATM on other OSes,
  327. * with different pseudo-headers.
  328. *
  329. * If ATM software returns a pseudo-header with VPI/VCI information
  330. * (and, ideally, packet type information, e.g. signalling, ILMI,
  331. * LANE, LLC-multiplexed traffic, etc.), it should not use
  332. * DLT_ATM_RFC1483, but should get a new DLT_ value, so tcpdump
  333. * and the like don't have to infer the presence or absence of a
  334. * pseudo-header and the form of the pseudo-header.
  335. */
  336. #define DLT_SUNATM 123 /* Solaris+SunATM */
  337. /*
  338. * Reserved as per request from Kent Dahlgren &lt;kent@praesum.com&gt;
  339. * for private use.
  340. */
  341. #define DLT_RIO 124 /* RapidIO */
  342. #define DLT_PCI_EXP 125 /* PCI Express */
  343. #define DLT_AURORA 126 /* Xilinx Aurora link layer */
  344. /*
  345. * Header for 802.11 plus a number of bits of link-layer information
  346. * including radio information, used by some recent BSD drivers as
  347. * well as the madwifi Atheros driver for Linux.
  348. */
  349. #define DLT_IEEE802_11_RADIO 127 /* 802.11 plus radiotap radio header */
  350. /*
  351. * Reserved for the TZSP encapsulation, as per request from
  352. * Chris Waters &lt;chris.waters@networkchemistry.com&gt;
  353. * TZSP is a generic encapsulation for any other link type,
  354. * which includes a means to include meta-information
  355. * with the packet, e.g. signal strength and channel
  356. * for 802.11 packets.
  357. */
  358. #define DLT_TZSP 128 /* Tazmen Sniffer Protocol */
  359. /*
  360. * BSD's ARCNET headers have the source host, destination host,
  361. * and type at the beginning of the packet; that's what's handed
  362. * up to userland via BPF.
  363. *
  364. * Linux's ARCNET headers, however, have a 2-byte offset field
  365. * between the host IDs and the type; that's what's handed up
  366. * to userland via PF_PACKET sockets.
  367. *
  368. * We therefore have to have separate DLT_ values for them.
  369. */
  370. #define DLT_ARCNET_LINUX 129 /* ARCNET */
  371. /*
  372. * Juniper-private data link types, as per request from
  373. * Hannes Gredler &lt;hannes@juniper.net&gt;. The DLT_s are used
  374. * for passing on chassis-internal metainformation such as
  375. * QOS profiles, etc..
  376. */
  377. #define DLT_JUNIPER_MLPPP 130
  378. #define DLT_JUNIPER_MLFR 131
  379. #define DLT_JUNIPER_ES 132
  380. #define DLT_JUNIPER_GGSN 133
  381. #define DLT_JUNIPER_MFR 134
  382. #define DLT_JUNIPER_ATM2 135
  383. #define DLT_JUNIPER_SERVICES 136
  384. #define DLT_JUNIPER_ATM1 137
  385. /*
  386. * Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund
  387. * &lt;dieter@apple.com&gt;. The header that's presented is an Ethernet-like
  388. * header:
  389. *
  390. * #define FIREWIRE_EUI64_LEN 8
  391. * struct firewire_header {
  392. * u_char firewire_dhost[FIREWIRE_EUI64_LEN];
  393. * u_char firewire_shost[FIREWIRE_EUI64_LEN];
  394. * u_short firewire_type;
  395. * };
  396. *
  397. * with &quot;firewire_type&quot; being an Ethernet type value, rather than,
  398. * for example, raw GASP frames being handed up.
  399. */
  400. #define DLT_APPLE_IP_OVER_IEEE1394 138
  401. /*
  402. * Various SS7 encapsulations, as per a request from Jeff Morriss
  403. * &lt;jeff.morriss[AT]ulticom.com&gt; and subsequent discussions.
  404. */
  405. #define DLT_MTP2_WITH_PHDR 139 /* pseudo-header with various info, followed by MTP2 */
  406. #define DLT_MTP2 140 /* MTP2, without pseudo-header */
  407. #define DLT_MTP3 141 /* MTP3, without pseudo-header or MTP2 */
  408. #define DLT_SCCP 142 /* SCCP, without pseudo-header or MTP2 or MTP3 */
  409. /*
  410. * DOCSIS MAC frames.
  411. */
  412. #define DLT_DOCSIS 143
  413. /*
  414. * Linux-IrDA packets. Protocol defined at http://www.irda.org.
  415. * Those packets include IrLAP headers and above (IrLMP...), but
  416. * don't include Phy framing (SOF/EOF/CRC &amp; byte stuffing), because Phy
  417. * framing can be handled by the hardware and depend on the bitrate.
  418. * This is exactly the format you would get capturing on a Linux-IrDA
  419. * interface (irdaX), but not on a raw serial port.
  420. * Note the capture is done in &quot;Linux-cooked&quot; mode, so each packet include
  421. * a fake packet header (struct sll_header). This is because IrDA packet
  422. * decoding is dependant on the direction of the packet (incomming or
  423. * outgoing).
  424. * When/if other platform implement IrDA capture, we may revisit the
  425. * issue and define a real DLT_IRDA...
  426. * Jean II
  427. */
  428. #define DLT_LINUX_IRDA 144
  429. /*
  430. * Reserved for IBM SP switch and IBM Next Federation switch.
  431. */
  432. #define DLT_IBM_SP 145
  433. #define DLT_IBM_SN 146
  434. /*
  435. * Reserved for private use. If you have some link-layer header type
  436. * that you want to use within your organization, with the capture files
  437. * using that link-layer header type not ever be sent outside your
  438. * organization, you can use these values.
  439. *
  440. * No libpcap release will use these for any purpose, nor will any
  441. * tcpdump release use them, either.
  442. *
  443. * Do *NOT* use these in capture files that you expect anybody not using
  444. * your private versions of capture-file-reading tools to read; in
  445. * particular, do *NOT* use them in products, otherwise you may find that
  446. * people won't be able to use tcpdump, or snort, or Ethereal, or... to
  447. * read capture files from your firewall/intrusion detection/traffic
  448. * monitoring/etc. appliance, or whatever product uses that DLT_ value,
  449. * and you may also find that the developers of those applications will
  450. * not accept patches to let them read those files.
  451. *
  452. * Also, do not use them if somebody might send you a capture using them
  453. * for *their* private type and tools using them for *your* private type
  454. * would have to read them.
  455. *
  456. * Instead, ask &quot;tcpdump-workers@lists.tcpdump.org&quot; for a new DLT_ value,
  457. * as per the comment above, and use the type you're given.
  458. */
  459. #define DLT_USER0 147
  460. #define DLT_USER1 148
  461. #define DLT_USER2 149
  462. #define DLT_USER3 150
  463. #define DLT_USER4 151
  464. #define DLT_USER5 152
  465. #define DLT_USER6 153
  466. #define DLT_USER7 154
  467. #define DLT_USER8 155
  468. #define DLT_USER9 156
  469. #define DLT_USER10 157
  470. #define DLT_USER11 158
  471. #define DLT_USER12 159
  472. #define DLT_USER13 160
  473. #define DLT_USER14 161
  474. #define DLT_USER15 162
  475. /*
  476. * For future use with 802.11 captures - defined by AbsoluteValue
  477. * Systems to store a number of bits of link-layer information
  478. * including radio information:
  479. *
  480. * http://www.shaftnet.org/~pizza/software/capturefrm.txt
  481. *
  482. * but it might be used by some non-AVS drivers now or in the
  483. * future.
  484. */
  485. #define DLT_IEEE802_11_RADIO_AVS 163 /* 802.11 plus AVS radio header */
  486. /*
  487. * Juniper-private data link type, as per request from
  488. * Hannes Gredler &lt;hannes@juniper.net&gt;. The DLT_s are used
  489. * for passing on chassis-internal metainformation such as
  490. * QOS profiles, etc..
  491. */
  492. #define DLT_JUNIPER_MONITOR 164
  493. /*
  494. * Reserved for BACnet MS/TP.
  495. */
  496. #define DLT_BACNET_MS_TP 165
  497. /*
  498. * Another PPP variant as per request from Karsten Keil &lt;kkeil@suse.de&gt;.
  499. *
  500. * This is used in some OSes to allow a kernel socket filter to distinguish
  501. * between incoming and outgoing packets, on a socket intended to
  502. * supply pppd with outgoing packets so it can do dial-on-demand and
  503. * hangup-on-lack-of-demand; incoming packets are filtered out so they
  504. * don't cause pppd to hold the connection up (you don't want random
  505. * input packets such as port scans, packets from old lost connections,
  506. * etc. to force the connection to stay up).
  507. *
  508. * The first byte of the PPP header (0xff03) is modified to accomodate
  509. * the direction - 0x00 = IN, 0x01 = OUT.
  510. */
  511. #define DLT_PPP_PPPD 166
  512. /*
  513. * Names for backwards compatibility with older versions of some PPP
  514. * software; new software should use DLT_PPP_PPPD.
  515. */
  516. #define DLT_PPP_WITH_DIRECTION DLT_PPP_PPPD
  517. #define DLT_LINUX_PPP_WITHDIRECTION DLT_PPP_PPPD
  518. /*
  519. * Juniper-private data link type, as per request from
  520. * Hannes Gredler &lt;hannes@juniper.net&gt;. The DLT_s are used
  521. * for passing on chassis-internal metainformation such as
  522. * QOS profiles, cookies, etc..
  523. */
  524. #define DLT_JUNIPER_PPPOE 167
  525. #define DLT_JUNIPER_PPPOE_ATM 168
  526. #define DLT_GPRS_LLC 169 /* GPRS LLC */
  527. #define DLT_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */
  528. #define DLT_GPF_F 171 /* GPF-F (ITU-T G.7041/Y.1303) */
  529. /*
  530. * Requested by Oolan Zimmer &lt;oz@gcom.com&gt; for use in Gcom's T1/E1 line
  531. * monitoring equipment.
  532. */
  533. #define DLT_GCOM_T1E1 172
  534. #define DLT_GCOM_SERIAL 173
  535. /*
  536. * Juniper-private data link type, as per request from
  537. * Hannes Gredler &lt;hannes@juniper.net&gt;. The DLT_ is used
  538. * for internal communication to Physical Interface Cards (PIC)
  539. */
  540. #define DLT_JUNIPER_PIC_PEER 174
  541. /*
  542. * Link types requested by Gregor Maier &lt;gregor@endace.com&gt; of Endace
  543. * Measurement Systems. They add an ERF header (see
  544. * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of
  545. * the link-layer header.
  546. */
  547. #define DLT_ERF_ETH 175 /* Ethernet */
  548. #define DLT_ERF_POS 176 /* Packet-over-SONET */
  549. /*
  550. * Requested by Daniele Orlandi &lt;daniele@orlandi.com&gt; for raw LAPD
  551. * for vISDN (http://www.orlandi.com/visdn/). Its link-layer header
  552. * includes additional information before the LAPD header, so it's
  553. * not necessarily a generic LAPD header.
  554. */
  555. #define DLT_LINUX_LAPD 177
  556. /*
  557. * Juniper-private data link type, as per request from
  558. * Hannes Gredler &lt;hannes@juniper.net&gt;.
  559. * The DLT_ are used for prepending meta-information
  560. * like interface index, interface name
  561. * before standard Ethernet, PPP, Frelay &amp; C-HDLC Frames
  562. */
  563. #define DLT_JUNIPER_ETHER 178
  564. #define DLT_JUNIPER_PPP 179
  565. #define DLT_JUNIPER_FRELAY 180
  566. #define DLT_JUNIPER_CHDLC 181
  567. /*
  568. * Multi Link Frame Relay (FRF.16)
  569. */
  570. #define DLT_MFR 182
  571. /*
  572. * Juniper-private data link type, as per request from
  573. * Hannes Gredler &lt;hannes@juniper.net&gt;.
  574. * The DLT_ is used for internal communication with a
  575. * voice Adapter Card (PIC)
  576. */
  577. #define DLT_JUNIPER_VP 183
  578. /*
  579. * Arinc 429 frames.
  580. * DLT_ requested by Gianluca Varenni &lt;gianluca.varenni@cacetech.com&gt;.
  581. * Every frame contains a 32bit A429 label.
  582. * More documentation on Arinc 429 can be found at
  583. * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
  584. */
  585. #define DLT_A429 184
  586. /*
  587. * Arinc 653 Interpartition Communication messages.
  588. * DLT_ requested by Gianluca Varenni &lt;gianluca.varenni@cacetech.com&gt;.
  589. * Please refer to the A653-1 standard for more information.
  590. */
  591. #define DLT_A653_ICM 185
  592. /*
  593. * USB packets, beginning with a USB setup header; requested by
  594. * Paolo Abeni &lt;paolo.abeni@email.it&gt;.
  595. */
  596. #define DLT_USB 186
  597. /*
  598. * Bluetooth HCI UART transport layer (part H:4); requested by
  599. * Paolo Abeni.
  600. */
  601. #define DLT_BLUETOOTH_HCI_H4 187
  602. /*
  603. * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
  604. * &lt;cruz_petagay@bah.com&gt;.
  605. */
  606. #define DLT_IEEE802_16_MAC_CPS 188
  607. /*
  608. * USB packets, beginning with a Linux USB header; requested by
  609. * Paolo Abeni &lt;paolo.abeni@email.it&gt;.
  610. */
  611. #define DLT_USB_LINUX 189
  612. /*
  613. * Controller Area Network (CAN) v. 2.0B packets.
  614. * DLT_ requested by Gianluca Varenni &lt;gianluca.varenni@cacetech.com&gt;.
  615. * Used to dump CAN packets coming from a CAN Vector board.
  616. * More documentation on the CAN v2.0B frames can be found at
  617. * http://www.can-cia.org/downloads/?269
  618. */
  619. #define DLT_CAN20B 190
  620. /*
  621. * IEEE 802.15.4, with address fields padded, as is done by Linux
  622. * drivers; requested by Juergen Schimmer.
  623. */
  624. #define DLT_IEEE802_15_4_LINUX 191
  625. /*
  626. * Per Packet Information encapsulated packets.
  627. * DLT_ requested by Gianluca Varenni &lt;gianluca.varenni@cacetech.com&gt;.
  628. */
  629. #define DLT_PPI 192
  630. /*
  631. * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
  632. * requested by Charles Clancy.
  633. */
  634. #define DLT_IEEE802_16_MAC_CPS_RADIO 193
  635. /*
  636. * Juniper-private data link type, as per request from
  637. * Hannes Gredler &lt;hannes@juniper.net&gt;.
  638. * The DLT_ is used for internal communication with a
  639. * integrated service module (ISM).
  640. */
  641. #define DLT_JUNIPER_ISM 194
  642. /*
  643. * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
  644. * nothing); requested by Mikko Saarnivala &lt;mikko.saarnivala@sensinode.com&gt;.
  645. */
  646. #define DLT_IEEE802_15_4 195
  647. /*
  648. * Various link-layer types, with a pseudo-header, for SITA
  649. * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).
  650. */
  651. #define DLT_SITA 196
  652. /*
  653. * Various link-layer types, with a pseudo-header, for Endace DAG cards;
  654. * encapsulates Endace ERF records. Requested by Stephen Donnelly
  655. * &lt;stephen@endace.com&gt;.
  656. */
  657. #define DLT_ERF 197
  658. /*
  659. * Special header prepended to Ethernet packets when capturing from a
  660. * u10 Networks board. Requested by Phil Mulholland
  661. * &lt;phil@u10networks.com&gt;.
  662. */
  663. #define DLT_RAIF1 198
  664. /*
  665. * IPMB packet for IPMI, beginning with the I2C slave address, followed
  666. * by the netFn and LUN, etc.. Requested by Chanthy Toeung
  667. * &lt;chanthy.toeung@ca.kontron.com&gt;.
  668. */
  669. #define DLT_IPMB 199
  670. /*
  671. * Juniper-private data link type, as per request from
  672. * Hannes Gredler &lt;hannes@juniper.net&gt;.
  673. * The DLT_ is used for capturing data on a secure tunnel interface.
  674. */
  675. #define DLT_JUNIPER_ST 200
  676. /*
  677. * Bluetooth HCI UART transport layer (part H:4), with pseudo-header
  678. * that includes direction information; requested by Paolo Abeni.
  679. */
  680. #define DLT_BLUETOOTH_HCI_H4_WITH_PHDR 201
  681. /*
  682. * AX.25 packet with a 1-byte KISS header; see
  683. *
  684. * http://www.ax25.net/kiss.htm
  685. *
  686. * as per Richard Stearn &lt;richard@rns-stearn.demon.co.uk&gt;.
  687. */
  688. #define DLT_AX25_KISS 202
  689. /*
  690. * LAPD packets from an ISDN channel, starting with the address field,
  691. * with no pseudo-header.
  692. * Requested by Varuna De Silva &lt;varunax@gmail.com&gt;.
  693. */
  694. #define DLT_LAPD 203
  695. /*
  696. * Variants of various link-layer headers, with a one-byte direction
  697. * pseudo-header prepended - zero means &quot;received by this host&quot;,
  698. * non-zero (any non-zero value) means &quot;sent by this host&quot; - as per
  699. * Will Barker &lt;w.barker@zen.co.uk&gt;.
  700. */
  701. #define DLT_PPP_WITH_DIR 204 /* PPP - don't confuse with DLT_PPP_WITH_DIRECTION */
  702. #define DLT_C_HDLC_WITH_DIR 205 /* Cisco HDLC */
  703. #define DLT_FRELAY_WITH_DIR 206 /* Frame Relay */
  704. #define DLT_LAPB_WITH_DIR 207 /* LAPB */
  705. /*
  706. * 208 is reserved for an as-yet-unspecified proprietary link-layer
  707. * type, as requested by Will Barker.
  708. */
  709. /*
  710. * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman
  711. * &lt;avn@pigeonpoint.com&gt;.
  712. */
  713. #define DLT_IPMB_LINUX 209
  714. /*
  715. * FlexRay automotive bus - http://www.flexray.com/ - as requested
  716. * by Hannes Kaelber &lt;hannes.kaelber@x2e.de&gt;.
  717. */
  718. #define DLT_FLEXRAY 210
  719. /*
  720. * Media Oriented Systems Transport (MOST) bus for multimedia
  721. * transport - http://www.mostcooperation.com/ - as requested
  722. * by Hannes Kaelber &lt;hannes.kaelber@x2e.de&gt;.
  723. */
  724. #define DLT_MOST 211
  725. /*
  726. * Local Interconnect Network (LIN) bus for vehicle networks -
  727. * http://www.lin-subbus.org/ - as requested by Hannes Kaelber
  728. * &lt;hannes.kaelber@x2e.de&gt;.
  729. */
  730. #define DLT_LIN 212
  731. /*
  732. * X2E-private data link type used for serial line capture,
  733. * as requested by Hannes Kaelber &lt;hannes.kaelber@x2e.de&gt;.
  734. */
  735. #define DLT_X2E_SERIAL 213
  736. /*
  737. * X2E-private data link type used for the Xoraya data logger
  738. * family, as requested by Hannes Kaelber &lt;hannes.kaelber@x2e.de&gt;.
  739. */
  740. #define DLT_X2E_XORAYA 214
  741. /*
  742. * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
  743. * nothing), but with the PHY-level data for non-ASK PHYs (4 octets
  744. * of 0 as preamble, one octet of SFD, one octet of frame length+
  745. * reserved bit, and then the MAC-layer data, starting with the
  746. * frame control field).
  747. *
  748. * Requested by Max Filippov &lt;jcmvbkbc@gmail.com&gt;.
  749. */
  750. #define DLT_IEEE802_15_4_NONASK_PHY 215
  751. /*
  752. * DLT and savefile link type values are split into a class and
  753. * a member of that class. A class value of 0 indicates a regular
  754. * DLT_/LINKTYPE_ value.
  755. */
  756. #define DLT_CLASS(x) ((x) &amp; 0x03ff0000)
  757. /*
  758. * NetBSD-specific generic &quot;raw&quot; link type. The class value indicates
  759. * that this is the generic raw type, and the lower 16 bits are the
  760. * address family we're dealing with. Those values are NetBSD-specific;
  761. * do not assume that they correspond to AF_ values for your operating
  762. * system.
  763. */
  764. #define DLT_CLASS_NETBSD_RAWAF 0x02240000
  765. #define DLT_NETBSD_RAWAF(af) (DLT_CLASS_NETBSD_RAWAF | (af))
  766. #define DLT_NETBSD_RAWAF_AF(x) ((x) &amp; 0x0000ffff)
  767. #define DLT_IS_NETBSD_RAWAF(x) (DLT_CLASS(x) == DLT_CLASS_NETBSD_RAWAF)
  768. /*
  769. * The instruction encodings.
  770. */
  771. /* instruction classes */
  772. #define BPF_CLASS(code) ((code) &amp; 0x07)
  773. #define BPF_LD 0x00
  774. #define BPF_LDX 0x01
  775. #define BPF_ST 0x02
  776. #define BPF_STX 0x03
  777. #define BPF_ALU 0x04
  778. #define BPF_JMP 0x05
  779. #define BPF_RET 0x06
  780. #define BPF_MISC 0x07
  781. /* ld/ldx fields */
  782. #define BPF_SIZE(code) ((code) &amp; 0x18)
  783. #define BPF_W 0x00
  784. #define BPF_H 0x08
  785. #define BPF_B 0x10
  786. #define BPF_MODE(code) ((code) &amp; 0xe0)
  787. #define BPF_IMM 0x00
  788. #define BPF_ABS 0x20
  789. #define BPF_IND 0x40
  790. #define BPF_MEM 0x60
  791. #define BPF_LEN 0x80
  792. #define BPF_MSH 0xa0
  793. /* alu/jmp fields */
  794. #define BPF_OP(code) ((code) &amp; 0xf0)
  795. #define BPF_ADD 0x00
  796. #define BPF_SUB 0x10
  797. #define BPF_MUL 0x20
  798. #define BPF_DIV 0x30
  799. #define BPF_OR 0x40
  800. #define BPF_AND 0x50
  801. #define BPF_LSH 0x60
  802. #define BPF_RSH 0x70
  803. #define BPF_NEG 0x80
  804. #define BPF_JA 0x00
  805. #define BPF_JEQ 0x10
  806. #define BPF_JGT 0x20
  807. #define BPF_JGE 0x30
  808. #define BPF_JSET 0x40
  809. #define BPF_SRC(code) ((code) &amp; 0x08)
  810. #define BPF_K 0x00
  811. #define BPF_X 0x08
  812. /* ret - BPF_K and BPF_X also apply */
  813. #define BPF_RVAL(code) ((code) &amp; 0x18)
  814. #define BPF_A 0x10
  815. /* misc */
  816. #define BPF_MISCOP(code) ((code) &amp; 0xf8)
  817. #define BPF_TAX 0x00
  818. #define BPF_TXA 0x80
  819. /*
  820. * The instruction data structure.
  821. */
  822. struct bpf_insn {
  823. u_short code;
  824. u_char jt;
  825. u_char jf;
  826. bpf_u_int32 k;
  827. };
  828. /*
  829. * Macros for insn array initializers.
  830. */
  831. #define BPF_STMT(code, k) { (u_short)(code), 0, 0, k }
  832. #define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k }
  833. #if __STDC__ || defined(__cplusplus)
  834. extern int bpf_validate(const struct bpf_insn *, int);
  835. extern u_int bpf_filter(const struct bpf_insn *, const u_char *, u_int, u_int);
  836. #else
  837. extern int bpf_validate();
  838. extern u_int bpf_filter();
  839. #endif
  840. /*
  841. * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
  842. */
  843. #define BPF_MEMWORDS 16
  844. #ifdef __cplusplus
  845. }
  846. #endif
  847. #endif
  848. </pre>
  849. <div class='footerlink'>
  850. [<a href='bluetooth.h.html' title=' bluetooth.h '>PREV</a>]
  851. [<a href='toolkit.html' title=' Index '>HOME</a>]
  852. [<a href='channel.h.html' title=' channel.h '>NEXT</a>]
  853. </div>
  854. </body>
  855. </html>