#include <net/bpf.h>

net/bpf.h

includes: stdint.h, net/if.h, sys/param.h, sys/appleapiopts.h, sys/types.h, sys/time.h, sys/cdefs.h, sys/_types/_timeval32.h

241 macros · 6 structs · 2 typedefs

macroBPF_RELEASE

BSD style release date

#define BPF_RELEASE 199606

typedefbpf_int32

typedef int32_t bpf_int32

typedefbpf_u_int32

typedef u_int32_t bpf_u_int32

macroBPF_ALIGNMENT

Alignment macros. BPF_WORDALIGN rounds up to the next even multiple of BPF_ALIGNMENT.

#define BPF_ALIGNMENT sizeof(int32_t)

macroBPF_WORDALIGN

#define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))

macroBPF_MAXINSNS

#define BPF_MAXINSNS 512

macroBPF_MAXBUFSIZE

#define BPF_MAXBUFSIZE 0x80000

macroBPF_MINBUFSIZE

#define BPF_MINBUFSIZE 32

structbpf_program

Structure for BIOCSETF.

size 16, align 8

u_int	bf_len
struct bpf_insn *	bf_insns

structbpf_stat

Struct returned by BIOCGSTATS.

size 8, align 4

u_int	bs_recv	number of packets received
u_int	bs_drop	number of packets dropped

Struct return by BIOCVERSION. This represents the version number of the filter language described by the instruction encodings below. bpf understands a program iff kernel_major == filter_major && kernel_minor >= filter_minor, that is, if the value returned by the running kernel has the same major number and a minor number equal equal to or less than the filter being downloaded. Otherwise, the results are undefined, meaning an error may be returned or packets may be accepted haphazardly. It has nothing to do with the source code version.

size 4, align 2

u_short	bv_major
u_short	bv_minor

macroBPF_TIMEVAL

#define BPF_TIMEVAL timeval32

macroBPF_MAJOR_VERSION

Current version number of filter architecture.

#define BPF_MAJOR_VERSION 1

macroBPF_MINOR_VERSION

#define BPF_MINOR_VERSION 1

macroBIOCGBLEN

#define BIOCGBLEN _IOR('B',102, u_int)

macroBIOCSBLEN

#define BIOCSBLEN _IOWR('B',102, u_int)

macroBIOCSETF

#define BIOCSETF _IOW('B',103, struct bpf_program)

macroBIOCFLUSH

#define BIOCFLUSH _IO('B',104)

macroBIOCPROMISC

#define BIOCPROMISC _IO('B',105)

macroBIOCGDLT

#define BIOCGDLT _IOR('B',106, u_int)

macroBIOCGETIF

#define BIOCGETIF _IOR('B',107, struct ifreq)

macroBIOCSETIF

#define BIOCSETIF _IOW('B',108, struct ifreq)

macroBIOCSRTIMEOUT

#define BIOCSRTIMEOUT _IOW('B',109, struct timeval)

macroBIOCGRTIMEOUT

#define BIOCGRTIMEOUT _IOR('B',110, struct timeval)

macroBIOCGSTATS

#define BIOCGSTATS _IOR('B',111, struct bpf_stat)

macroBIOCIMMEDIATE

#define BIOCIMMEDIATE _IOW('B',112, u_int)

macroBIOCVERSION

#define BIOCVERSION _IOR('B',113, struct bpf_version)

macroBIOCGRSIG

#define BIOCGRSIG _IOR('B',114, u_int)

macroBIOCSRSIG

#define BIOCSRSIG _IOW('B',115, u_int)

macroBIOCGHDRCMPLT

#define BIOCGHDRCMPLT _IOR('B',116, u_int)

macroBIOCSHDRCMPLT

#define BIOCSHDRCMPLT _IOW('B',117, u_int)

macroBIOCGSEESENT

#define BIOCGSEESENT _IOR('B',118, u_int)

macroBIOCSSEESENT

#define BIOCSSEESENT _IOW('B',119, u_int)

macroBIOCSDLT

#define BIOCSDLT _IOW('B',120, u_int)

macroBIOCGDLTLIST

#define BIOCGDLTLIST _IOWR('B',121, struct bpf_dltlist)

macroBIOCSETFNR

#define BIOCSETFNR _IOW('B', 126, struct bpf_program)

structbpf_hdr

Structure prepended to each packet.

size 20, align 4

struct timeval32	bh_tstamp	time stamp
bpf_u_int32	bh_caplen	length of captured portion
bpf_u_int32	bh_datalen	original length of packet
u_short	bh_hdrlen	length of bpf header (this struct plus alignment padding)

macroDLT_NULL

Data-link level type codes.

#define DLT_NULL 0

no link-layer encapsulation

macroDLT_EN10MB

#define DLT_EN10MB 1

Ethernet (10Mb)

macroDLT_EN3MB

#define DLT_EN3MB 2

Experimental Ethernet (3Mb)

macroDLT_AX25

#define DLT_AX25 3

Amateur Radio AX.25

macroDLT_PRONET

#define DLT_PRONET 4

Proteon ProNET Token Ring

macroDLT_CHAOS

#define DLT_CHAOS 5

Chaos

macroDLT_IEEE802

#define DLT_IEEE802 6

IEEE 802 Networks

macroDLT_ARCNET

#define DLT_ARCNET 7

ARCNET

macroDLT_SLIP

#define DLT_SLIP 8

Serial Line IP

macroDLT_PPP

#define DLT_PPP 9

Point-to-point Protocol

macroDLT_FDDI

#define DLT_FDDI 10

FDDI

macroDLT_ATM_RFC1483

#define DLT_ATM_RFC1483 11

LLC/SNAP encapsulated atm

macroDLT_RAW

#define DLT_RAW 12

raw IP

macroDLT_SLIP_BSDOS

These are values from BSD/OS's "bpf.h". These are not the same as the values from the traditional libpcap "bpf.h"; however, these values shouldn't be generated by any OS other than BSD/OS, so the correct values to use here are the BSD/OS values. Platforms that have already assigned these values to other DLT_ codes, however, should give these codes the values from that platform, so that programs that use these codes will continue to compile - even though they won't correctly read files of these types.

#define DLT_SLIP_BSDOS 15

BSD/OS Serial Line IP

macroDLT_PPP_BSDOS

#define DLT_PPP_BSDOS 16

BSD/OS Point-to-point Protocol

macroDLT_PFSYNC

18 is used for DLT_PFSYNC in OpenBSD, NetBSD, DragonFly BSD and Mac OS X; don't use it for anything else. (FreeBSD uses 121, which collides with DLT_HHDLC, even though it doesn't use 18 for anything and doesn't appear to have ever used it for anything.) We define it as 18 on those platforms; it is, unfortunately, used for DLT_CIP in Suse 6.3, so we don't define it as DLT_PFSYNC in general. As the packet format for it, like that for DLT_PFLOG, is not only OS-dependent but OS-version-dependent, we don't support printing it in tcpdump except on OSes that have the relevant header files, so it's not that useful on other platforms.

#define DLT_PFSYNC 18

Packet filter state syncing

macroDLT_ATM_CLIP

#define DLT_ATM_CLIP 19

Linux Classical-IP over ATM

macroDLT_PPP_SERIAL

These values are defined by NetBSD; other platforms should refrain from using them for other purposes, so that NetBSD savefiles with link types of 50 or 51 can be read as this type on all platforms.

#define DLT_PPP_SERIAL 50

PPP over serial with HDLC encapsulation

macroDLT_PPP_ETHER

#define DLT_PPP_ETHER 51

PPP over Ethernet

macroDLT_SYMANTEC_FIREWALL

The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses a link-layer type of 99 for the tcpdump it supplies. The link-layer header has 6 bytes of unknown data, something that appears to be an Ethernet type, and 36 bytes that appear to be 0 in at least one capture I've seen.

#define DLT_SYMANTEC_FIREWALL 99

macroDLT_MATCHING_MIN

Values starting with 104 are used for newly-assigned link-layer header type values; for those link-layer header types, the DLT_ value returned by pcap_datalink() and passed to pcap_open_dead(), and the LINKTYPE_ value that appears in capture files, are the same. DLT_MATCHING_MIN is the lowest such value; DLT_MATCHING_MAX is the highest such value.

#define DLT_MATCHING_MIN 104

macroDLT_C_HDLC

This value was defined by libpcap 0.5; platforms that have defined it with a different value should define it here with that value - a link type of 104 in a save file will be mapped to DLT_C_HDLC, whatever value that happens to be, so programs will correctly handle files with that link type regardless of the value of DLT_C_HDLC. The name DLT_C_HDLC was used by BSD/OS; we use that name for source compatibility with programs written for BSD/OS. libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well, for source compatibility with programs written for libpcap 0.5.

#define DLT_C_HDLC 104

Cisco HDLC

macroDLT_CHDLC

#define DLT_CHDLC DLT_C_HDLC

macroDLT_IEEE802_11

#define DLT_IEEE802_11 105

IEEE 802.11 wireless

macroDLT_FRELAY

Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides with other values. DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header (DLCI, etc.).

#define DLT_FRELAY 107

macroDLT_LOOP

OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except that the AF_ type in the link-layer header is in network byte order. OpenBSD defines it as 12, but that collides with DLT_RAW, so we define it as 108 here. If OpenBSD picks up this file, it should define DLT_LOOP as 12 in its version, as per the comment above - and should not use 108 for any purpose.

#define DLT_LOOP 108

macroDLT_ENC

Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other than OpenBSD.

#define DLT_ENC 109

macroDLT_LINUX_SLL

This is for Linux cooked sockets.

#define DLT_LINUX_SLL 113

macroDLT_LTALK

Apple LocalTalk hardware.

#define DLT_LTALK 114

macroDLT_ECONET

Acorn Econet.

#define DLT_ECONET 115

macroDLT_IPFILTER

Reserved for use with OpenBSD ipfilter.

#define DLT_IPFILTER 116

macroDLT_PFLOG

For use in capture-file headers as a link-layer type corresponding to OpenBSD PF (Packet Filter) log.

#define DLT_PFLOG 117

macroDLT_CISCO_IOS

Registered for Cisco-internal use.

#define DLT_CISCO_IOS 118

macroDLT_PRISM_HEADER

Reserved for 802.11 cards using the Prism II chips, with a link-layer header including Prism monitor mode information plus an 802.11 header.

#define DLT_PRISM_HEADER 119

macroDLT_AIRONET_HEADER

Reserved for Aironet 802.11 cards, with an Aironet link-layer header (see Doug Ambrisko's FreeBSD patches).

#define DLT_AIRONET_HEADER 120

macroDLT_HHDLC

Reserved for Siemens HiPath HDLC. XXX

#define DLT_HHDLC 121

macroDLT_IP_OVER_FC

Reserved for RFC 2625 IP-over-Fibre Channel.

#define DLT_IP_OVER_FC 122

macroDLT_SUNATM

Reserved for Full Frontal ATM on Solaris.

#define DLT_SUNATM 123

macroDLT_RIO

Reserved as per request from Kent Dahlgren <kent@praesum.com> for private use.

#define DLT_RIO 124

RapidIO

macroDLT_PCI_EXP

#define DLT_PCI_EXP 125

PCI Express

macroDLT_AURORA

#define DLT_AURORA 126

Xilinx Aurora link layer

macroDLT_IEEE802_11_RADIO

BSD header for 802.11 plus a number of bits of link-layer information including radio information.

#define DLT_IEEE802_11_RADIO 127

macroDLT_TZSP

Reserved for TZSP encapsulation.

#define DLT_TZSP 128

Tazmen Sniffer Protocol

macroDLT_ARCNET_LINUX

Reserved for Linux ARCNET.

#define DLT_ARCNET_LINUX 129

macroDLT_JUNIPER_MLPPP

Juniper-private data link types.

#define DLT_JUNIPER_MLPPP 130

macroDLT_JUNIPER_MLFR

#define DLT_JUNIPER_MLFR 131

macroDLT_JUNIPER_ES

#define DLT_JUNIPER_ES 132

macroDLT_JUNIPER_GGSN

#define DLT_JUNIPER_GGSN 133

macroDLT_JUNIPER_MFR

#define DLT_JUNIPER_MFR 134

macroDLT_JUNIPER_ATM2

#define DLT_JUNIPER_ATM2 135

macroDLT_JUNIPER_SERVICES

#define DLT_JUNIPER_SERVICES 136

macroDLT_JUNIPER_ATM1

#define DLT_JUNIPER_ATM1 137

macroDLT_APPLE_IP_OVER_IEEE1394

Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund <dieter@apple.com>. The header that's presented is an Ethernet-like header: #define FIREWIRE_EUI64_LEN 8 struct firewire_header { u_char firewire_dhost[FIREWIRE_EUI64_LEN]; u_char firewire_shost[FIREWIRE_EUI64_LEN]; u_short firewire_type; }; with "firewire_type" being an Ethernet type value, rather than, for example, raw GASP frames being handed up.

#define DLT_APPLE_IP_OVER_IEEE1394 138

macroDLT_MTP2_WITH_PHDR

Various SS7 encapsulations, as per a request from Jeff Morriss <jeff.morriss[AT]ulticom.com> and subsequent discussions.

#define DLT_MTP2_WITH_PHDR 139

pseudo-header with various info, followed by MTP2

macroDLT_MTP2

#define DLT_MTP2 140

MTP2, without pseudo-header

macroDLT_MTP3

#define DLT_MTP3 141

MTP3, without pseudo-header or MTP2

macroDLT_SCCP

#define DLT_SCCP 142

SCCP, without pseudo-header or MTP2 or MTP3

macroDLT_DOCSIS

Reserved for DOCSIS.

#define DLT_DOCSIS 143

macroDLT_LINUX_IRDA

Reserved for Linux IrDA.

#define DLT_LINUX_IRDA 144

macroDLT_IBM_SP

Reserved for IBM SP switch and IBM Next Federation switch.

#define DLT_IBM_SP 145

macroDLT_IBM_SN

#define DLT_IBM_SN 146

macroDLT_USER0

Reserved for private use. If you have some link-layer header type that you want to use within your organization, with the capture files using that link-layer header type not ever be sent outside your organization, you can use these values. No libpcap release will use these for any purpose, nor will any tcpdump release use them, either. Do *NOT* use these in capture files that you expect anybody not using your private versions of capture-file-reading tools to read; in particular, do *NOT* use them in products, otherwise you may find that people won't be able to use tcpdump, or snort, or Ethereal, or... to read capture files from your firewall/intrusion detection/traffic monitoring/etc. appliance, or whatever product uses that DLT_ value, and you may also find that the developers of those applications will not accept patches to let them read those files. Also, do not use them if somebody might send you a capture using them for *their* private type and tools using them for *your* private type would have to read them. Instead, ask "tcpdump-workers@tcpdump.org" for a new DLT_ value, as per the comment above, and use the type you're given.

#define DLT_USER0 147

macroDLT_USER1

#define DLT_USER1 148

macroDLT_USER2

#define DLT_USER2 149

macroDLT_USER3

#define DLT_USER3 150

macroDLT_USER4

#define DLT_USER4 151

macroDLT_USER5

#define DLT_USER5 152

macroDLT_USER6

#define DLT_USER6 153

macroDLT_USER7

#define DLT_USER7 154

macroDLT_USER8

#define DLT_USER8 155

macroDLT_USER9

#define DLT_USER9 156

macroDLT_USER10

#define DLT_USER10 157

macroDLT_USER11

#define DLT_USER11 158

macroDLT_USER12

#define DLT_USER12 159

macroDLT_USER13

#define DLT_USER13 160

macroDLT_USER14

#define DLT_USER14 161

macroDLT_USER15

#define DLT_USER15 162

macroDLT_IEEE802_11_RADIO_AVS

For future use with 802.11 captures - defined by AbsoluteValue Systems to store a number of bits of link-layer information including radio information: http://www.shaftnet.org/~pizza/software/capturefrm.txt but it might be used by some non-AVS drivers now or in the future.

#define DLT_IEEE802_11_RADIO_AVS 163

802.11 plus AVS radio header

macroDLT_JUNIPER_MONITOR

Juniper-private data link type, as per request from Hannes Gredler <hannes@juniper.net>. The DLT_s are used for passing on chassis-internal metainformation such as QOS profiles, etc..

#define DLT_JUNIPER_MONITOR 164

macroDLT_BACNET_MS_TP

Reserved for BACnet MS/TP.

#define DLT_BACNET_MS_TP 165

macroDLT_PPP_PPPD

Another PPP variant as per request from Karsten Keil <kkeil@suse.de>. This is used in some OSes to allow a kernel socket filter to distinguish between incoming and outgoing packets, on a socket intended to supply pppd with outgoing packets so it can do dial-on-demand and hangup-on-lack-of-demand; incoming packets are filtered out so they don't cause pppd to hold the connection up (you don't want random input packets such as port scans, packets from old lost connections, etc. to force the connection to stay up). The first byte of the PPP header (0xff03) is modified to accomodate the direction - 0x00 = IN, 0x01 = OUT.

#define DLT_PPP_PPPD 166

macroDLT_PPP_WITH_DIRECTION

Names for backwards compatibility with older versions of some PPP software; new software should use DLT_PPP_PPPD.

#define DLT_PPP_WITH_DIRECTION DLT_PPP_PPPD

macroDLT_LINUX_PPP_WITHDIRECTION

#define DLT_LINUX_PPP_WITHDIRECTION DLT_PPP_PPPD

macroDLT_JUNIPER_PPPOE

Juniper-private data link type, as per request from Hannes Gredler <hannes@juniper.net>. The DLT_s are used for passing on chassis-internal metainformation such as QOS profiles, cookies, etc..

#define DLT_JUNIPER_PPPOE 167

macroDLT_JUNIPER_PPPOE_ATM

#define DLT_JUNIPER_PPPOE_ATM 168

macroDLT_GPRS_LLC

#define DLT_GPRS_LLC 169

GPRS LLC

macroDLT_GPF_T

#define DLT_GPF_T 170

GPF-T (ITU-T G.7041/Y.1303)

macroDLT_GPF_F

#define DLT_GPF_F 171

GPF-F (ITU-T G.7041/Y.1303)

macroDLT_GCOM_T1E1

Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line monitoring equipment.

#define DLT_GCOM_T1E1 172

macroDLT_GCOM_SERIAL

#define DLT_GCOM_SERIAL 173

macroDLT_JUNIPER_PIC_PEER

Juniper-private data link type, as per request from Hannes Gredler <hannes@juniper.net>. The DLT_ is used for internal communication to Physical Interface Cards (PIC)

#define DLT_JUNIPER_PIC_PEER 174

macroDLT_ERF_ETH

Link types requested by Gregor Maier <gregor@endace.com> of Endace Measurement Systems. They add an ERF header (see http://www.endace.com/support/EndaceRecordFormat.pdf) in front of the link-layer header.

#define DLT_ERF_ETH 175

Ethernet

macroDLT_ERF_POS

#define DLT_ERF_POS 176

Packet-over-SONET

macroDLT_LINUX_LAPD

Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD for vISDN (http://www.orlandi.com/visdn/). Its link-layer header includes additional information before the LAPD header, so it's not necessarily a generic LAPD header.

#define DLT_LINUX_LAPD 177

macroDLT_JUNIPER_ETHER

Juniper-private data link type, as per request from Hannes Gredler <hannes@juniper.net>. The DLT_ are used for prepending meta-information like interface index, interface name before standard Ethernet, PPP, Frelay & C-HDLC Frames

#define DLT_JUNIPER_ETHER 178

macroDLT_JUNIPER_PPP

#define DLT_JUNIPER_PPP 179

macroDLT_JUNIPER_FRELAY

#define DLT_JUNIPER_FRELAY 180

macroDLT_JUNIPER_CHDLC

#define DLT_JUNIPER_CHDLC 181

macroDLT_MFR

Multi Link Frame Relay (FRF.16)

#define DLT_MFR 182

macroDLT_JUNIPER_VP

Juniper-private data link type, as per request from Hannes Gredler <hannes@juniper.net>. The DLT_ is used for internal communication with a voice Adapter Card (PIC)

#define DLT_JUNIPER_VP 183

macroDLT_A429

Arinc 429 frames. DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. Every frame contains a 32bit A429 label. More documentation on Arinc 429 can be found at http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf

#define DLT_A429 184

macroDLT_A653_ICM

Arinc 653 Interpartition Communication messages. DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. Please refer to the A653-1 standard for more information.

#define DLT_A653_ICM 185

macroDLT_USB

USB packets, beginning with a USB setup header; requested by Paolo Abeni <paolo.abeni@email.it>.

#define DLT_USB 186

macroDLT_BLUETOOTH_HCI_H4

Bluetooth HCI UART transport layer (part H:4); requested by Paolo Abeni.

#define DLT_BLUETOOTH_HCI_H4 187

macroDLT_IEEE802_16_MAC_CPS

IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz <cruz_petagay@bah.com>.

#define DLT_IEEE802_16_MAC_CPS 188

macroDLT_USB_LINUX

USB packets, beginning with a Linux USB header; requested by Paolo Abeni <paolo.abeni@email.it>.

#define DLT_USB_LINUX 189

macroDLT_CAN20B

Controller Area Network (CAN) v. 2.0B packets. DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>. Used to dump CAN packets coming from a CAN Vector board. More documentation on the CAN v2.0B frames can be found at http://www.can-cia.org/downloads/?269

#define DLT_CAN20B 190

macroDLT_IEEE802_15_4_LINUX

IEEE 802.15.4, with address fields padded, as is done by Linux drivers; requested by Juergen Schimmer.

#define DLT_IEEE802_15_4_LINUX 191

macroDLT_PPI

Per Packet Information encapsulated packets. DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.

#define DLT_PPI 192

macroDLT_IEEE802_16_MAC_CPS_RADIO

Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header; requested by Charles Clancy.

#define DLT_IEEE802_16_MAC_CPS_RADIO 193

macroDLT_JUNIPER_ISM

Juniper-private data link type, as per request from Hannes Gredler <hannes@juniper.net>. The DLT_ is used for internal communication with a integrated service module (ISM).

#define DLT_JUNIPER_ISM 194

macroDLT_IEEE802_15_4

IEEE 802.15.4, exactly as it appears in the spec (no padding, no nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.

#define DLT_IEEE802_15_4 195

macroDLT_SITA

Various link-layer types, with a pseudo-header, for SITA (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).

#define DLT_SITA 196

macroDLT_ERF

Various link-layer types, with a pseudo-header, for Endace DAG cards; encapsulates Endace ERF records. Requested by Stephen Donnelly <stephen@endace.com>.

#define DLT_ERF 197

macroDLT_RAIF1

Special header prepended to Ethernet packets when capturing from a u10 Networks board. Requested by Phil Mulholland <phil@u10networks.com>.

#define DLT_RAIF1 198

macroDLT_IPMB

IPMB packet for IPMI, beginning with the I2C slave address, followed by the netFn and LUN, etc.. Requested by Chanthy Toeung <chanthy.toeung@ca.kontron.com>.

#define DLT_IPMB 199

macroDLT_JUNIPER_ST

Juniper-private data link type, as per request from Hannes Gredler <hannes@juniper.net>. The DLT_ is used for capturing data on a secure tunnel interface.

#define DLT_JUNIPER_ST 200

macroDLT_BLUETOOTH_HCI_H4_WITH_PHDR

Bluetooth HCI UART transport layer (part H:4), with pseudo-header that includes direction information; requested by Paolo Abeni.

#define DLT_BLUETOOTH_HCI_H4_WITH_PHDR 201

macroDLT_AX25_KISS

AX.25 packet with a 1-byte KISS header; see http://www.ax25.net/kiss.htm as per Richard Stearn <richard@rns-stearn.demon.co.uk>.

#define DLT_AX25_KISS 202

macroDLT_LAPD

LAPD packets from an ISDN channel, starting with the address field, with no pseudo-header. Requested by Varuna De Silva <varunax@gmail.com>.

#define DLT_LAPD 203

macroDLT_PPP_WITH_DIR

Variants of various link-layer headers, with a one-byte direction pseudo-header prepended - zero means "received by this host", non-zero (any non-zero value) means "sent by this host" - as per Will Barker <w.barker@zen.co.uk>.

#define DLT_PPP_WITH_DIR 204

PPP - don't confuse with DLT_PPP_WITH_DIRECTION

macroDLT_C_HDLC_WITH_DIR

#define DLT_C_HDLC_WITH_DIR 205

Cisco HDLC

macroDLT_FRELAY_WITH_DIR

#define DLT_FRELAY_WITH_DIR 206

Frame Relay

macroDLT_LAPB_WITH_DIR

#define DLT_LAPB_WITH_DIR 207

LAPB

macroDLT_IPMB_LINUX

IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman <avn@pigeonpoint.com>.

#define DLT_IPMB_LINUX 209

macroDLT_FLEXRAY

FlexRay automotive bus - http://www.flexray.com/ - as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.

#define DLT_FLEXRAY 210

macroDLT_MOST

Media Oriented Systems Transport (MOST) bus for multimedia transport - http://www.mostcooperation.com/ - as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.

#define DLT_MOST 211

macroDLT_LIN

Local Interconnect Network (LIN) bus for vehicle networks - http://www.lin-subbus.org/ - as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.

#define DLT_LIN 212

macroDLT_X2E_SERIAL

X2E-private data link type used for serial line capture, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.

#define DLT_X2E_SERIAL 213

macroDLT_X2E_XORAYA

X2E-private data link type used for the Xoraya data logger family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.

#define DLT_X2E_XORAYA 214

macroDLT_IEEE802_15_4_NONASK_PHY

IEEE 802.15.4, exactly as it appears in the spec (no padding, no nothing), but with the PHY-level data for non-ASK PHYs (4 octets of 0 as preamble, one octet of SFD, one octet of frame length+ reserved bit, and then the MAC-layer data, starting with the frame control field). Requested by Max Filippov <jcmvbkbc@gmail.com>.

#define DLT_IEEE802_15_4_NONASK_PHY 215

macroDLT_LINUX_EVDEV

David Gibson <david@gibson.dropbear.id.au> requested this for captures from the Linux kernel /dev/input/eventN devices. This is used to communicate keystrokes and mouse movements from the Linux kernel to display systems, such as Xorg.

#define DLT_LINUX_EVDEV 216

macroDLT_GSMTAP_UM

GSM Um and Abis interfaces, preceded by a "gsmtap" header. Requested by Harald Welte <laforge@gnumonks.org>.

#define DLT_GSMTAP_UM 217

macroDLT_GSMTAP_ABIS

#define DLT_GSMTAP_ABIS 218

macroDLT_MPLS

MPLS, with an MPLS label as the link-layer header. Requested by Michele Marchetto <michele@openbsd.org> on behalf of OpenBSD.

#define DLT_MPLS 219

macroDLT_USB_LINUX_MMAPPED

USB packets, beginning with a Linux USB header, with the USB header padded to 64 bytes; required for memory-mapped access.

#define DLT_USB_LINUX_MMAPPED 220

macroDLT_DECT

DECT packets, with a pseudo-header; requested by Matthias Wenzel <tcpdump@mazzoo.de>.

#define DLT_DECT 221

macroDLT_AOS

From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov> Date: Mon, 11 May 2009 11:18:30 -0500 DLT_AOS. We need it for AOS Space Data Link Protocol. I have already written dissectors for but need an OK from legal before I can submit a patch.

#define DLT_AOS 222

macroDLT_WIHART

Wireless HART (Highway Addressable Remote Transducer) From the HART Communication Foundation IES/PAS 62591 Requested by Sam Roberts <vieuxtech@gmail.com>.

#define DLT_WIHART 223

macroDLT_FC_2

Fibre Channel FC-2 frames, beginning with a Frame_Header. Requested by Kahou Lei <kahou82@gmail.com>.

#define DLT_FC_2 224

macroDLT_FC_2_WITH_FRAME_DELIMS

Fibre Channel FC-2 frames, beginning with an encoding of the SOF, and ending with an encoding of the EOF. The encodings represent the frame delimiters as 4-byte sequences representing the corresponding ordered sets, with K28.5 represented as 0xBC, and the D symbols as the corresponding byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2, is represented as 0xBC 0xB5 0x55 0x55. Requested by Kahou Lei <kahou82@gmail.com>.

#define DLT_FC_2_WITH_FRAME_DELIMS 225

macroDLT_IPNET

Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>. The pseudo-header starts with a one-byte version number; for version 2, the pseudo-header is: struct dl_ipnetinfo { u_int8_t dli_version; u_int8_t dli_family; u_int16_t dli_htype; u_int32_t dli_pktlen; u_int32_t dli_ifindex; u_int32_t dli_grifindex; u_int32_t dli_zsrc; u_int32_t dli_zdst; }; dli_version is 2 for the current version of the pseudo-header. dli_family is a Solaris address family value, so it's 2 for IPv4 and 26 for IPv6. dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing packets, and 2 for packets arriving from another zone on the same machine. dli_pktlen is the length of the packet data following the pseudo-header (so the captured length minus dli_pktlen is the length of the pseudo-header, assuming the entire pseudo-header was captured). dli_ifindex is the interface index of the interface on which the packet arrived. dli_grifindex is the group interface index number (for IPMP interfaces). dli_zsrc is the zone identifier for the source of the packet. dli_zdst is the zone identifier for the destination of the packet. A zone number of 0 is the global zone; a zone number of 0xffffffff means that the packet arrived from another host on the network, not from another zone on the same machine. An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates which of those it is.

#define DLT_IPNET 226

macroDLT_CAN_SOCKETCAN

CAN (Controller Area Network) frames, with a pseudo-header as supplied by Linux SocketCAN. See Documentation/networking/can.txt in the Linux source. Requested by Felix Obenhuber <felix@obenhuber.de>.

#define DLT_CAN_SOCKETCAN 227

macroDLT_IPV4

Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies whether it's v4 or v6. Requested by Darren Reed <Darren.Reed@Sun.COM>.

#define DLT_IPV4 228

macroDLT_IPV6

#define DLT_IPV6 229

macroDLT_IEEE802_15_4_NOFCS

IEEE 802.15.4, exactly as it appears in the spec (no padding, no nothing), and with no FCS at the end of the frame; requested by Jon Smirl <jonsmirl@gmail.com>.

#define DLT_IEEE802_15_4_NOFCS 230

macroDLT_DBUS

Raw D-Bus: http://www.freedesktop.org/wiki/Software/dbus messages: http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages starting with the endianness flag, followed by the message type, etc., but without the authentication handshake before the message sequence: http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol Requested by Martin Vidner <martin@vidner.net>.

#define DLT_DBUS 231

macroDLT_JUNIPER_VS

Juniper-private data link type, as per request from Hannes Gredler <hannes@juniper.net>.

#define DLT_JUNIPER_VS 232

macroDLT_JUNIPER_SRX_E2E

#define DLT_JUNIPER_SRX_E2E 233

macroDLT_JUNIPER_FIBRECHANNEL

#define DLT_JUNIPER_FIBRECHANNEL 234

macroDLT_DVB_CI

DVB-CI (DVB Common Interface for communication between a PC Card module and a DVB receiver). See http://www.kaiser.cx/pcap-dvbci.html for the specification. Requested by Martin Kaiser <martin@kaiser.cx>.

#define DLT_DVB_CI 235

macroDLT_MUX27010

Variant of 3GPP TS 27.010 multiplexing protocol (similar to, but *not* the same as, 27.010). Requested by Hans-Christoph Schemmel <hans-christoph.schemmel@cinterion.com>.

#define DLT_MUX27010 236

macroDLT_STANAG_5066_D_PDU

STANAG 5066 D_PDUs. Requested by M. Baris Demiray <barisdemiray@gmail.com>.

#define DLT_STANAG_5066_D_PDU 237

macroDLT_JUNIPER_ATM_CEMIC

Juniper-private data link type, as per request from Hannes Gredler <hannes@juniper.net>.

#define DLT_JUNIPER_ATM_CEMIC 238

macroDLT_NFLOG

NetFilter LOG messages (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets) Requested by Jakub Zawadzki <darkjames-ws@darkjames.pl>

#define DLT_NFLOG 239

macroDLT_NETANALYZER

Hilscher Gesellschaft fuer Systemautomation mbH link-layer type for Ethernet packets with a 4-byte pseudo-header and always with the payload including the FCS, as supplied by their netANALYZER hardware and software. Requested by Holger P. Frommer <HPfrommer@hilscher.com>

#define DLT_NETANALYZER 240

macroDLT_NETANALYZER_TRANSPARENT

Hilscher Gesellschaft fuer Systemautomation mbH link-layer type for Ethernet packets with a 4-byte pseudo-header and FCS and with the Ethernet header preceded by 7 bytes of preamble and 1 byte of SFD, as supplied by their netANALYZER hardware and software. Requested by Holger P. Frommer <HPfrommer@hilscher.com>

#define DLT_NETANALYZER_TRANSPARENT 241

macroDLT_IPOIB

IP-over-Infiniband, as specified by RFC 4391. Requested by Petr Sumbera <petr.sumbera@oracle.com>.

#define DLT_IPOIB 242

macroDLT_MPEG_2_TS

MPEG-2 transport stream (ISO 13818-1/ITU-T H.222.0). Requested by Guy Martin <gmsoft@tuxicoman.be>.

#define DLT_MPEG_2_TS 243

macroDLT_NG40

ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as used by their ng40 protocol tester. Requested by Jens Grimmer <jens.grimmer@ng4t.com>.

#define DLT_NG40 244

macroDLT_NFC_LLCP

Pseudo-header giving adapter number and flags, followed by an NFC (Near-Field Communications) Logical Link Control Protocol (LLCP) PDU, as specified by NFC Forum Logical Link Control Protocol Technical Specification LLCP 1.1. Requested by Mike Wakerly <mikey@google.com>.

#define DLT_NFC_LLCP 245

macroDLT_USB_DARWIN

USB packets, beginning with a Darwin (macOS, etc.) USB header.

#define DLT_USB_DARWIN 266

macroDLT_MATCHING_MAX

#define DLT_MATCHING_MAX 266

highest value in the "matching" range

macroBPF_CLASS

The instruction encodings. instruction classes

#define BPF_CLASS(code) ((code) & 0x07)

macroBPF_LD

#define BPF_LD 0x00

macroBPF_LDX

#define BPF_LDX 0x01

macroBPF_ST

#define BPF_ST 0x02

macroBPF_STX

#define BPF_STX 0x03

macroBPF_ALU

#define BPF_ALU 0x04

macroBPF_JMP

#define BPF_JMP 0x05

macroBPF_RET

#define BPF_RET 0x06

macroBPF_MISC

#define BPF_MISC 0x07

macroBPF_SIZE

ld/ldx fields

#define BPF_SIZE(code) ((code) & 0x18)

macroBPF_W

#define BPF_W 0x00

macroBPF_H

#define BPF_H 0x08

macroBPF_B

#define BPF_B 0x10

macroBPF_MODE

#define BPF_MODE(code) ((code) & 0xe0)

macroBPF_IMM

#define BPF_IMM 0x00

macroBPF_ABS

#define BPF_ABS 0x20

macroBPF_IND

#define BPF_IND 0x40

macroBPF_MEM

#define BPF_MEM 0x60

macroBPF_LEN

#define BPF_LEN 0x80

macroBPF_MSH

#define BPF_MSH 0xa0

macroBPF_OP

alu/jmp fields

#define BPF_OP(code) ((code) & 0xf0)

macroBPF_ADD

#define BPF_ADD 0x00

macroBPF_SUB

#define BPF_SUB 0x10

macroBPF_MUL

#define BPF_MUL 0x20

macroBPF_DIV

#define BPF_DIV 0x30

macroBPF_OR

#define BPF_OR 0x40

macroBPF_AND

#define BPF_AND 0x50

macroBPF_LSH

#define BPF_LSH 0x60

macroBPF_RSH

#define BPF_RSH 0x70

macroBPF_NEG

#define BPF_NEG 0x80

macroBPF_JA

#define BPF_JA 0x00

macroBPF_JEQ

#define BPF_JEQ 0x10

macroBPF_JGT

#define BPF_JGT 0x20

macroBPF_JGE

#define BPF_JGE 0x30

macroBPF_JSET

#define BPF_JSET 0x40

macroBPF_SRC

#define BPF_SRC(code) ((code) & 0x08)

macroBPF_K

#define BPF_K 0x00

macroBPF_X

#define BPF_X 0x08

macroBPF_RVAL

ret - BPF_K and BPF_X also apply

#define BPF_RVAL(code) ((code) & 0x18)

macroBPF_A

#define BPF_A 0x10

macroBPF_MISCOP

misc

#define BPF_MISCOP(code) ((code) & 0xf8)

macroBPF_TAX

#define BPF_TAX 0x00

macroBPF_TXA

#define BPF_TXA 0x80

macroBPF_MEMWORDS

Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).

#define BPF_MEMWORDS 16

structbpf_insn

The instruction data structure.