"Fossies" - the Fresh Open Source Software Archive

Member "daq-2.0.7/sfbpf/sfbpf_dlt.h" (8 Apr 2020, 29791 Bytes) of package /linux/misc/daq-2.0.7.tar.gz:


As a special service "Fossies" has tried to format the requested source page into HTML format using (guessed) C and C++ source code syntax highlighting (style: standard) with prefixed line numbers and code folding option. Alternatively you can here view or download the uninterpreted source code file. For more information about "sfbpf_dlt.h" see the Fossies "Dox" file reference documentation and the latest Fossies "Diffs" side-by-side code changes report: 2.0.6_vs_2.0.7.

    1 /*-
    2  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
    3  *  The Regents of the University of California.  All rights reserved.
    4  *
    5  * Some portions Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
    6  * Some portions Copyright (C) 2010-2013 Sourcefire, Inc.
    7  *
    8  * This code is derived from the Stanford/CMU enet packet filter,
    9  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
   10  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence 
   11  * Berkeley Laboratory.
   12  *
   13  * Redistribution and use in source and binary forms, with or without
   14  * modification, are permitted provided that the following conditions
   15  * are met:
   16  * 1. Redistributions of source code must retain the above copyright
   17  *    notice, this list of conditions and the following disclaimer.
   18  * 2. Redistributions in binary form must reproduce the above copyright
   19  *    notice, this list of conditions and the following disclaimer in the
   20  *    documentation and/or other materials provided with the distribution.
   21  * 3. All advertising materials mentioning features or use of this software
   22  *    must display the following acknowledgement:
   23  *      This product includes software developed by the University of
   24  *      California, Berkeley and its contributors.
   25  * 4. Neither the name of the University nor the names of its contributors
   26  *    may be used to endorse or promote products derived from this software
   27  *    without specific prior written permission.
   28  *
   29  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
   30  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   31  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   32  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
   33  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   34  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   35  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   36  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   37  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   38  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   39  * SUCH DAMAGE.
   40  *
   41  *      @(#)bpf.h       7.1 (Berkeley) 5/7/91
   42  *
   43  * @(#) $Header: //depot/firepower/daq-opensource/DAQ_2_0_7/sfbpf/sfbpf_dlt.h#1 $ (LBL)
   44  */
   45 
   46 /*
   47  * This is just the DLT_* definitions as taken from libpcap-1.0.0's bpf.h.
   48  */
   49 
   50 #ifndef _SFBPF_DLT_H
   51 #define _SFBPF_DLT_H
   52 
   53 /*
   54  * Data-link level type codes.
   55  *
   56  * Do *NOT* add new values to this list without asking
   57  * "tcpdump-workers@lists.tcpdump.org" for a value.  Otherwise, you run
   58  * the risk of using a value that's already being used for some other
   59  * purpose, and of having tools that read libpcap-format captures not
   60  * being able to handle captures with your new DLT_ value, with no hope
   61  * that they will ever be changed to do so (as that would destroy their
   62  * ability to read captures using that value for that other purpose).
   63  */
   64 
   65 /*
   66  * These are the types that are the same on all platforms, and that
   67  * have been defined by <net/bpf.h> for ages.
   68  */
   69 #define DLT_NULL    0   /* BSD loopback encapsulation */
   70 #define DLT_EN10MB  1   /* Ethernet (10Mb) */
   71 #define DLT_EN3MB   2   /* Experimental Ethernet (3Mb) */
   72 #define DLT_AX25    3   /* Amateur Radio AX.25 */
   73 #define DLT_PRONET  4   /* Proteon ProNET Token Ring */
   74 #define DLT_CHAOS   5   /* Chaos */
   75 #define DLT_IEEE802 6   /* 802.5 Token Ring */
   76 #define DLT_ARCNET  7   /* ARCNET, with BSD-style header */
   77 #define DLT_SLIP    8   /* Serial Line IP */
   78 #define DLT_PPP     9   /* Point-to-point Protocol */
   79 #define DLT_FDDI    10  /* FDDI */
   80 
   81 /*
   82  * These are types that are different on some platforms, and that
   83  * have been defined by <net/bpf.h> for ages.  We use #ifdefs to
   84  * detect the BSDs that define them differently from the traditional
   85  * libpcap <net/bpf.h>
   86  *
   87  * XXX - DLT_ATM_RFC1483 is 13 in BSD/OS, and DLT_RAW is 14 in BSD/OS,
   88  * but I don't know what the right #define is for BSD/OS.
   89  */
   90 #define DLT_ATM_RFC1483 11  /* LLC-encapsulated ATM */
   91 
   92 #ifdef __OpenBSD__
   93 #define DLT_RAW     14  /* raw IP */
   94 #else
   95 #define DLT_RAW     12  /* raw IP */
   96 #endif
   97 
   98 /*
   99  * Given that the only OS that currently generates BSD/OS SLIP or PPP
  100  * is, well, BSD/OS, arguably everybody should have chosen its values
  101  * for DLT_SLIP_BSDOS and DLT_PPP_BSDOS, which are 15 and 16, but they
  102  * didn't.  So it goes.
  103  */
  104 #if defined(__NetBSD__) || defined(__FreeBSD__)
  105 #ifndef DLT_SLIP_BSDOS
  106 #define DLT_SLIP_BSDOS  13  /* BSD/OS Serial Line IP */
  107 #define DLT_PPP_BSDOS   14  /* BSD/OS Point-to-point Protocol */
  108 #endif
  109 #else
  110 #define DLT_SLIP_BSDOS  15  /* BSD/OS Serial Line IP */
  111 #define DLT_PPP_BSDOS   16  /* BSD/OS Point-to-point Protocol */
  112 #endif
  113 
  114 /*
  115  * 17 is used for DLT_OLD_PFLOG in OpenBSD;
  116  *     OBSOLETE: DLT_PFLOG is 117 in OpenBSD now as well. See below.
  117  * 18 is used for DLT_PFSYNC in OpenBSD; don't use it for anything else.
  118  */
  119 
  120 #define DLT_ATM_CLIP    19  /* Linux Classical-IP over ATM */
  121 
  122 /*
  123  * Apparently Redback uses this for its SmartEdge 400/800.  I hope
  124  * nobody else decided to use it, too.
  125  */
  126 #define DLT_REDBACK_SMARTEDGE   32
  127 
  128 /*
  129  * These values are defined by NetBSD; other platforms should refrain from
  130  * using them for other purposes, so that NetBSD savefiles with link
  131  * types of 50 or 51 can be read as this type on all platforms.
  132  */
  133 #define DLT_PPP_SERIAL  50  /* PPP over serial with HDLC encapsulation */
  134 #define DLT_PPP_ETHER   51  /* PPP over Ethernet */
  135 
  136 /*
  137  * The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses
  138  * a link-layer type of 99 for the tcpdump it supplies.  The link-layer
  139  * header has 6 bytes of unknown data, something that appears to be an
  140  * Ethernet type, and 36 bytes that appear to be 0 in at least one capture
  141  * I've seen.
  142  */
  143 #define DLT_SYMANTEC_FIREWALL   99
  144 
  145 /*
  146  * Values between 100 and 103 are used in capture file headers as
  147  * link-layer types corresponding to DLT_ types that differ
  148  * between platforms; don't use those values for new DLT_ new types.
  149  */
  150 
  151 /*
  152  * This value was defined by libpcap 0.5; platforms that have defined
  153  * it with a different value should define it here with that value -
  154  * a link type of 104 in a save file will be mapped to DLT_C_HDLC,
  155  * whatever value that happens to be, so programs will correctly
  156  * handle files with that link type regardless of the value of
  157  * DLT_C_HDLC.
  158  *
  159  * The name DLT_C_HDLC was used by BSD/OS; we use that name for source
  160  * compatibility with programs written for BSD/OS.
  161  *
  162  * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
  163  * for source compatibility with programs written for libpcap 0.5.
  164  */
  165 #define DLT_C_HDLC  104 /* Cisco HDLC */
  166 #define DLT_CHDLC   DLT_C_HDLC
  167 
  168 #define DLT_IEEE802_11  105 /* IEEE 802.11 wireless */
  169 
  170 /*
  171  * 106 is reserved for Linux Classical IP over ATM; it's like DLT_RAW,
  172  * except when it isn't.  (I.e., sometimes it's just raw IP, and
  173  * sometimes it isn't.)  We currently handle it as DLT_LINUX_SLL,
  174  * so that we don't have to worry about the link-layer header.)
  175  */
  176 
  177 /*
  178  * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides
  179  * with other values.
  180  * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header
  181  * (DLCI, etc.).
  182  */
  183 #define DLT_FRELAY  107
  184 
  185 /*
  186  * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
  187  * that the AF_ type in the link-layer header is in network byte order.
  188  *
  189  * DLT_LOOP is 12 in OpenBSD, but that's DLT_RAW in other OSes, so
  190  * we don't use 12 for it in OSes other than OpenBSD.
  191  */
  192 #ifdef __OpenBSD__
  193 #define DLT_LOOP    12
  194 #else
  195 #define DLT_LOOP    108
  196 #endif
  197 
  198 /*
  199  * Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's
  200  * DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other
  201  * than OpenBSD.
  202  */
  203 #ifdef __OpenBSD__
  204 #define DLT_ENC     13
  205 #else
  206 #define DLT_ENC     109
  207 #endif
  208 
  209 /*
  210  * Values between 110 and 112 are reserved for use in capture file headers
  211  * as link-layer types corresponding to DLT_ types that might differ
  212  * between platforms; don't use those values for new DLT_ types
  213  * other than the corresponding DLT_ types.
  214  */
  215 
  216 /*
  217  * This is for Linux cooked sockets.
  218  */
  219 #define DLT_LINUX_SLL   113
  220 
  221 /*
  222  * Apple LocalTalk hardware.
  223  */
  224 #define DLT_LTALK   114
  225 
  226 /*
  227  * Acorn Econet.
  228  */
  229 #define DLT_ECONET  115
  230 
  231 /*
  232  * Reserved for use with OpenBSD ipfilter.
  233  */
  234 #define DLT_IPFILTER    116
  235 
  236 /*
  237  * OpenBSD DLT_PFLOG; DLT_PFLOG is 17 in OpenBSD, but that's DLT_LANE8023
  238  * in SuSE 6.3, so we can't use 17 for it in capture-file headers.
  239  *
  240  * XXX: is there a conflict with DLT_PFSYNC 18 as well?
  241  */
  242 #ifdef __OpenBSD__
  243 #define DLT_OLD_PFLOG   17
  244 #define DLT_PFSYNC  18
  245 #endif
  246 #define DLT_PFLOG   117
  247 
  248 /*
  249  * Registered for Cisco-internal use.
  250  */
  251 #define DLT_CISCO_IOS   118
  252 
  253 /*
  254  * For 802.11 cards using the Prism II chips, with a link-layer
  255  * header including Prism monitor mode information plus an 802.11
  256  * header.
  257  */
  258 #define DLT_PRISM_HEADER    119
  259 
  260 /*
  261  * Reserved for Aironet 802.11 cards, with an Aironet link-layer header
  262  * (see Doug Ambrisko's FreeBSD patches).
  263  */
  264 #define DLT_AIRONET_HEADER  120
  265 
  266 /*
  267  * Reserved for Siemens HiPath HDLC.
  268  */
  269 #define DLT_HHDLC       121
  270 
  271 /*
  272  * This is for RFC 2625 IP-over-Fibre Channel.
  273  *
  274  * This is not for use with raw Fibre Channel, where the link-layer
  275  * header starts with a Fibre Channel frame header; it's for IP-over-FC,
  276  * where the link-layer header starts with an RFC 2625 Network_Header
  277  * field.
  278  */
  279 #define DLT_IP_OVER_FC      122
  280 
  281 /*
  282  * This is for Full Frontal ATM on Solaris with SunATM, with a
  283  * pseudo-header followed by an AALn PDU.
  284  *
  285  * There may be other forms of Full Frontal ATM on other OSes,
  286  * with different pseudo-headers.
  287  *
  288  * If ATM software returns a pseudo-header with VPI/VCI information
  289  * (and, ideally, packet type information, e.g. signalling, ILMI,
  290  * LANE, LLC-multiplexed traffic, etc.), it should not use
  291  * DLT_ATM_RFC1483, but should get a new DLT_ value, so tcpdump
  292  * and the like don't have to infer the presence or absence of a
  293  * pseudo-header and the form of the pseudo-header.
  294  */
  295 #define DLT_SUNATM      123 /* Solaris+SunATM */
  296 
  297 /* 
  298  * Reserved as per request from Kent Dahlgren <kent@praesum.com>
  299  * for private use.
  300  */
  301 #define DLT_RIO                 124     /* RapidIO */
  302 #define DLT_PCI_EXP             125     /* PCI Express */
  303 #define DLT_AURORA              126     /* Xilinx Aurora link layer */
  304 
  305 /*
  306  * Header for 802.11 plus a number of bits of link-layer information
  307  * including radio information, used by some recent BSD drivers as
  308  * well as the madwifi Atheros driver for Linux.
  309  */
  310 #define DLT_IEEE802_11_RADIO    127 /* 802.11 plus radiotap radio header */
  311 
  312 /*
  313  * Reserved for the TZSP encapsulation, as per request from
  314  * Chris Waters <chris.waters@networkchemistry.com>
  315  * TZSP is a generic encapsulation for any other link type,
  316  * which includes a means to include meta-information
  317  * with the packet, e.g. signal strength and channel
  318  * for 802.11 packets.
  319  */
  320 #define DLT_TZSP                128     /* Tazmen Sniffer Protocol */
  321 
  322 /*
  323  * BSD's ARCNET headers have the source host, destination host,
  324  * and type at the beginning of the packet; that's what's handed
  325  * up to userland via BPF.
  326  *
  327  * Linux's ARCNET headers, however, have a 2-byte offset field
  328  * between the host IDs and the type; that's what's handed up
  329  * to userland via PF_PACKET sockets.
  330  *
  331  * We therefore have to have separate DLT_ values for them.
  332  */
  333 #define DLT_ARCNET_LINUX    129 /* ARCNET */
  334 
  335 /*
  336  * Juniper-private data link types, as per request from
  337  * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
  338  * for passing on chassis-internal metainformation such as
  339  * QOS profiles, etc..
  340  */
  341 #define DLT_JUNIPER_MLPPP       130
  342 #define DLT_JUNIPER_MLFR        131
  343 #define DLT_JUNIPER_ES          132
  344 #define DLT_JUNIPER_GGSN        133
  345 #define DLT_JUNIPER_MFR         134
  346 #define DLT_JUNIPER_ATM2        135
  347 #define DLT_JUNIPER_SERVICES    136
  348 #define DLT_JUNIPER_ATM1        137
  349 
  350 /*
  351  * Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund
  352  * <dieter@apple.com>.  The header that's presented is an Ethernet-like
  353  * header:
  354  *
  355  *  #define FIREWIRE_EUI64_LEN  8
  356  *  struct firewire_header {
  357  *      u_char  firewire_dhost[FIREWIRE_EUI64_LEN];
  358  *      u_char  firewire_shost[FIREWIRE_EUI64_LEN];
  359  *      u_short firewire_type;
  360  *  };
  361  *
  362  * with "firewire_type" being an Ethernet type value, rather than,
  363  * for example, raw GASP frames being handed up.
  364  */
  365 #define DLT_APPLE_IP_OVER_IEEE1394  138
  366 
  367 /*
  368  * Various SS7 encapsulations, as per a request from Jeff Morriss
  369  * <jeff.morriss[AT]ulticom.com> and subsequent discussions.
  370  */
  371 #define DLT_MTP2_WITH_PHDR  139 /* pseudo-header with various info, followed by MTP2 */
  372 #define DLT_MTP2        140 /* MTP2, without pseudo-header */
  373 #define DLT_MTP3        141 /* MTP3, without pseudo-header or MTP2 */
  374 #define DLT_SCCP        142 /* SCCP, without pseudo-header or MTP2 or MTP3 */
  375 
  376 /*
  377  * DOCSIS MAC frames.
  378  */
  379 #define DLT_DOCSIS      143
  380 
  381 /*
  382  * Linux-IrDA packets. Protocol defined at http://www.irda.org.
  383  * Those packets include IrLAP headers and above (IrLMP...), but
  384  * don't include Phy framing (SOF/EOF/CRC & byte stuffing), because Phy
  385  * framing can be handled by the hardware and depend on the bitrate.
  386  * This is exactly the format you would get capturing on a Linux-IrDA
  387  * interface (irdaX), but not on a raw serial port.
  388  * Note the capture is done in "Linux-cooked" mode, so each packet include
  389  * a fake packet header (struct sll_header). This is because IrDA packet
  390  * decoding is dependant on the direction of the packet (incomming or
  391  * outgoing).
  392  * When/if other platform implement IrDA capture, we may revisit the
  393  * issue and define a real DLT_IRDA...
  394  * Jean II
  395  */
  396 #define DLT_LINUX_IRDA      144
  397 
  398 /*
  399  * Reserved for IBM SP switch and IBM Next Federation switch.
  400  */
  401 #define DLT_IBM_SP      145
  402 #define DLT_IBM_SN      146
  403 
  404 /*
  405  * Reserved for private use.  If you have some link-layer header type
  406  * that you want to use within your organization, with the capture files
  407  * using that link-layer header type not ever be sent outside your
  408  * organization, you can use these values.
  409  *
  410  * No libpcap release will use these for any purpose, nor will any
  411  * tcpdump release use them, either.
  412  *
  413  * Do *NOT* use these in capture files that you expect anybody not using
  414  * your private versions of capture-file-reading tools to read; in
  415  * particular, do *NOT* use them in products, otherwise you may find that
  416  * people won't be able to use tcpdump, or snort, or Ethereal, or... to
  417  * read capture files from your firewall/intrusion detection/traffic
  418  * monitoring/etc. appliance, or whatever product uses that DLT_ value,
  419  * and you may also find that the developers of those applications will
  420  * not accept patches to let them read those files.
  421  *
  422  * Also, do not use them if somebody might send you a capture using them
  423  * for *their* private type and tools using them for *your* private type
  424  * would have to read them.
  425  *
  426  * Instead, ask "tcpdump-workers@lists.tcpdump.org" for a new DLT_ value,
  427  * as per the comment above, and use the type you're given.
  428  */
  429 #define DLT_USER0       147
  430 #define DLT_USER1       148
  431 #define DLT_USER2       149
  432 #define DLT_USER3       150
  433 #define DLT_USER4       151
  434 #define DLT_USER5       152
  435 #define DLT_USER6       153
  436 #define DLT_USER7       154
  437 #define DLT_USER8       155
  438 #define DLT_USER9       156
  439 #define DLT_USER10      157
  440 #define DLT_USER11      158
  441 #define DLT_USER12      159
  442 #define DLT_USER13      160
  443 #define DLT_USER14      161
  444 #define DLT_USER15      162
  445 
  446 /*
  447  * For future use with 802.11 captures - defined by AbsoluteValue
  448  * Systems to store a number of bits of link-layer information
  449  * including radio information:
  450  *
  451  *  http://www.shaftnet.org/~pizza/software/capturefrm.txt
  452  *
  453  * but it might be used by some non-AVS drivers now or in the
  454  * future.
  455  */
  456 #define DLT_IEEE802_11_RADIO_AVS 163    /* 802.11 plus AVS radio header */
  457 
  458 /*
  459  * Juniper-private data link type, as per request from
  460  * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
  461  * for passing on chassis-internal metainformation such as
  462  * QOS profiles, etc..
  463  */
  464 #define DLT_JUNIPER_MONITOR     164
  465 
  466 /*
  467  * Reserved for BACnet MS/TP.
  468  */
  469 #define DLT_BACNET_MS_TP    165
  470 
  471 /*
  472  * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>.
  473  *
  474  * This is used in some OSes to allow a kernel socket filter to distinguish
  475  * between incoming and outgoing packets, on a socket intended to
  476  * supply pppd with outgoing packets so it can do dial-on-demand and
  477  * hangup-on-lack-of-demand; incoming packets are filtered out so they
  478  * don't cause pppd to hold the connection up (you don't want random
  479  * input packets such as port scans, packets from old lost connections,
  480  * etc. to force the connection to stay up).
  481  *
  482  * The first byte of the PPP header (0xff03) is modified to accomodate
  483  * the direction - 0x00 = IN, 0x01 = OUT.
  484  */
  485 #define DLT_PPP_PPPD        166
  486 
  487 /*
  488  * Names for backwards compatibility with older versions of some PPP
  489  * software; new software should use DLT_PPP_PPPD.
  490  */
  491 #define DLT_PPP_WITH_DIRECTION  DLT_PPP_PPPD
  492 #define DLT_LINUX_PPP_WITHDIRECTION DLT_PPP_PPPD
  493 
  494 /*
  495  * Juniper-private data link type, as per request from
  496  * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
  497  * for passing on chassis-internal metainformation such as
  498  * QOS profiles, cookies, etc..
  499  */
  500 #define DLT_JUNIPER_PPPOE       167
  501 #define DLT_JUNIPER_PPPOE_ATM   168
  502 
  503 #define DLT_GPRS_LLC        169 /* GPRS LLC */
  504 #define DLT_GPF_T       170 /* GPF-T (ITU-T G.7041/Y.1303) */
  505 #define DLT_GPF_F       171 /* GPF-F (ITU-T G.7041/Y.1303) */
  506 
  507 /*
  508  * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line
  509  * monitoring equipment.
  510  */
  511 #define DLT_GCOM_T1E1       172
  512 #define DLT_GCOM_SERIAL     173
  513 
  514 /*
  515  * Juniper-private data link type, as per request from
  516  * Hannes Gredler <hannes@juniper.net>.  The DLT_ is used
  517  * for internal communication to Physical Interface Cards (PIC)
  518  */
  519 #define DLT_JUNIPER_PIC_PEER    174
  520 
  521 /*
  522  * Link types requested by Gregor Maier <gregor@endace.com> of Endace
  523  * Measurement Systems.  They add an ERF header (see
  524  * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of
  525  * the link-layer header.
  526  */
  527 #define DLT_ERF_ETH     175 /* Ethernet */
  528 #define DLT_ERF_POS     176 /* Packet-over-SONET */
  529 
  530 /*
  531  * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD
  532  * for vISDN (http://www.orlandi.com/visdn/).  Its link-layer header
  533  * includes additional information before the LAPD header, so it's
  534  * not necessarily a generic LAPD header.
  535  */
  536 #define DLT_LINUX_LAPD      177
  537 
  538 /*
  539  * Juniper-private data link type, as per request from
  540  * Hannes Gredler <hannes@juniper.net>. 
  541  * The DLT_ are used for prepending meta-information
  542  * like interface index, interface name
  543  * before standard Ethernet, PPP, Frelay & C-HDLC Frames
  544  */
  545 #define DLT_JUNIPER_ETHER       178
  546 #define DLT_JUNIPER_PPP         179
  547 #define DLT_JUNIPER_FRELAY      180
  548 #define DLT_JUNIPER_CHDLC       181
  549 
  550 /*
  551  * Multi Link Frame Relay (FRF.16)
  552  */
  553 #define DLT_MFR                 182
  554 
  555 /*
  556  * Juniper-private data link type, as per request from
  557  * Hannes Gredler <hannes@juniper.net>. 
  558  * The DLT_ is used for internal communication with a
  559  * voice Adapter Card (PIC)
  560  */
  561 #define DLT_JUNIPER_VP          183
  562 
  563 /*
  564  * Arinc 429 frames.
  565  * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
  566  * Every frame contains a 32bit A429 label.
  567  * More documentation on Arinc 429 can be found at
  568  * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
  569  */
  570 #define DLT_A429                184
  571 
  572 /*
  573  * Arinc 653 Interpartition Communication messages.
  574  * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
  575  * Please refer to the A653-1 standard for more information.
  576  */
  577 #define DLT_A653_ICM            185
  578 
  579 /*
  580  * USB packets, beginning with a USB setup header; requested by
  581  * Paolo Abeni <paolo.abeni@email.it>.
  582  */
  583 #define DLT_USB         186
  584 
  585 /*
  586  * Bluetooth HCI UART transport layer (part H:4); requested by
  587  * Paolo Abeni.
  588  */
  589 #define DLT_BLUETOOTH_HCI_H4    187
  590 
  591 /*
  592  * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
  593  * <cruz_petagay@bah.com>.
  594  */
  595 #define DLT_IEEE802_16_MAC_CPS  188
  596 
  597 /*
  598  * USB packets, beginning with a Linux USB header; requested by
  599  * Paolo Abeni <paolo.abeni@email.it>.
  600  */
  601 #define DLT_USB_LINUX       189
  602 
  603 /*
  604  * Controller Area Network (CAN) v. 2.0B packets.
  605  * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
  606  * Used to dump CAN packets coming from a CAN Vector board.
  607  * More documentation on the CAN v2.0B frames can be found at
  608  * http://www.can-cia.org/downloads/?269
  609  */
  610 #define DLT_CAN20B              190
  611 
  612 /*
  613  * IEEE 802.15.4, with address fields padded, as is done by Linux
  614  * drivers; requested by Juergen Schimmer.
  615  */
  616 #define DLT_IEEE802_15_4_LINUX  191
  617 
  618 /*
  619  * Per Packet Information encapsulated packets.
  620  * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
  621  */
  622 #define DLT_PPI         192
  623 
  624 /*
  625  * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
  626  * requested by Charles Clancy.
  627  */
  628 #define DLT_IEEE802_16_MAC_CPS_RADIO    193
  629 
  630 /*
  631  * Juniper-private data link type, as per request from
  632  * Hannes Gredler <hannes@juniper.net>. 
  633  * The DLT_ is used for internal communication with a
  634  * integrated service module (ISM).
  635  */
  636 #define DLT_JUNIPER_ISM         194
  637 
  638 /*
  639  * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
  640  * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.
  641  */
  642 #define DLT_IEEE802_15_4    195
  643 
  644 /*
  645  * Various link-layer types, with a pseudo-header, for SITA
  646  * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).
  647  */
  648 #define DLT_SITA        196
  649 
  650 /*
  651  * Various link-layer types, with a pseudo-header, for Endace DAG cards;
  652  * encapsulates Endace ERF records.  Requested by Stephen Donnelly
  653  * <stephen@endace.com>.
  654  */
  655 #define DLT_ERF         197
  656 
  657 /*
  658  * Special header prepended to Ethernet packets when capturing from a
  659  * u10 Networks board.  Requested by Phil Mulholland
  660  * <phil@u10networks.com>.
  661  */
  662 #define DLT_RAIF1       198
  663 
  664 /*
  665  * IPMB packet for IPMI, beginning with the I2C slave address, followed
  666  * by the netFn and LUN, etc..  Requested by Chanthy Toeung
  667  * <chanthy.toeung@ca.kontron.com>.
  668  */
  669 #define DLT_IPMB        199
  670 
  671 /*
  672  * Juniper-private data link type, as per request from
  673  * Hannes Gredler <hannes@juniper.net>. 
  674  * The DLT_ is used for capturing data on a secure tunnel interface.
  675  */
  676 #define DLT_JUNIPER_ST          200
  677 
  678 /*
  679  * Bluetooth HCI UART transport layer (part H:4), with pseudo-header
  680  * that includes direction information; requested by Paolo Abeni.
  681  */
  682 #define DLT_BLUETOOTH_HCI_H4_WITH_PHDR  201
  683 
  684 /*
  685  * AX.25 packet with a 1-byte KISS header; see
  686  *
  687  *  http://www.ax25.net/kiss.htm
  688  *
  689  * as per Richard Stearn <richard@rns-stearn.demon.co.uk>.
  690  */
  691 #define DLT_AX25_KISS       202
  692 
  693 /*
  694  * LAPD packets from an ISDN channel, starting with the address field,
  695  * with no pseudo-header.
  696  * Requested by Varuna De Silva <varunax@gmail.com>.
  697  */
  698 #define DLT_LAPD        203
  699 
  700 /*
  701  * Variants of various link-layer headers, with a one-byte direction
  702  * pseudo-header prepended - zero means "received by this host",
  703  * non-zero (any non-zero value) means "sent by this host" - as per
  704  * Will Barker <w.barker@zen.co.uk>.
  705  */
  706 #define DLT_PPP_WITH_DIR    204 /* PPP - don't confuse with DLT_PPP_WITH_DIRECTION */
  707 #define DLT_C_HDLC_WITH_DIR 205 /* Cisco HDLC */
  708 #define DLT_FRELAY_WITH_DIR 206 /* Frame Relay */
  709 #define DLT_LAPB_WITH_DIR   207 /* LAPB */
  710 
  711 /*
  712  * 208 is reserved for an as-yet-unspecified proprietary link-layer
  713  * type, as requested by Will Barker.
  714  */
  715 
  716 /*
  717  * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman
  718  * <avn@pigeonpoint.com>.
  719  */
  720 #define DLT_IPMB_LINUX      209
  721 
  722 /*
  723  * FlexRay automotive bus - http://www.flexray.com/ - as requested
  724  * by Hannes Kaelber <hannes.kaelber@x2e.de>.
  725  */
  726 #define DLT_FLEXRAY     210
  727 
  728 /*
  729  * Media Oriented Systems Transport (MOST) bus for multimedia
  730  * transport - http://www.mostcooperation.com/ - as requested
  731  * by Hannes Kaelber <hannes.kaelber@x2e.de>.
  732  */
  733 #define DLT_MOST        211
  734 
  735 /*
  736  * Local Interconnect Network (LIN) bus for vehicle networks -
  737  * http://www.lin-subbus.org/ - as requested by Hannes Kaelber
  738  * <hannes.kaelber@x2e.de>.
  739  */
  740 #define DLT_LIN         212
  741 
  742 /*
  743  * X2E-private data link type used for serial line capture,
  744  * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
  745  */
  746 #define DLT_X2E_SERIAL      213
  747 
  748 /*
  749  * X2E-private data link type used for the Xoraya data logger
  750  * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
  751  */
  752 #define DLT_X2E_XORAYA      214
  753 
  754 /*
  755  * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
  756  * nothing), but with the PHY-level data for non-ASK PHYs (4 octets
  757  * of 0 as preamble, one octet of SFD, one octet of frame length+
  758  * reserved bit, and then the MAC-layer data, starting with the
  759  * frame control field).
  760  *
  761  * Requested by Max Filippov <jcmvbkbc@gmail.com>.
  762  */
  763 #define DLT_IEEE802_15_4_NONASK_PHY 215
  764 
  765 /* 
  766  * David Gibson <david@gibson.dropbear.id.au> requested this for
  767  * captures from the Linux kernel /dev/input/eventN devices. This
  768  * is used to communicate keystrokes and mouse movements from the
  769  * Linux kernel to display systems, such as Xorg. 
  770  */
  771 #define DLT_LINUX_EVDEV     216
  772 
  773 /*
  774  * GSM Um and Abis interfaces, preceded by a "gsmtap" header.
  775  *
  776  * Requested by Harald Welte <laforge@gnumonks.org>.
  777  */
  778 #define DLT_GSMTAP_UM       217
  779 #define DLT_GSMTAP_ABIS     218
  780 
  781 /*
  782  * MPLS, with an MPLS label as the link-layer header.
  783  * Requested by Michele Marchetto <michele@openbsd.org> on behalf
  784  * of OpenBSD.
  785  */
  786 #define DLT_MPLS        219
  787 
  788 /*
  789  * USB packets, beginning with a Linux USB header, with the USB header
  790  * padded to 64 bytes; required for memory-mapped access.
  791  */
  792 #define DLT_USB_LINUX_MMAPPED   220
  793 
  794 /*
  795  * DECT packets, with a pseudo-header; requested by
  796  * Matthias Wenzel <tcpdump@mazzoo.de>.
  797  */
  798 #define DLT_DECT        221
  799 
  800 /*
  801  * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov>
  802  * Date: Mon, 11 May 2009 11:18:30 -0500
  803  *
  804  * DLT_AOS. We need it for AOS Space Data Link Protocol.
  805  *   I have already written dissectors for but need an OK from
  806  *   legal before I can submit a patch.
  807  *
  808  */
  809 #define DLT_AOS                 222
  810 
  811 /*
  812  * Wireless HART (Highway Addressable Remote Transducer)
  813  * From the HART Communication Foundation
  814  * IES/PAS 62591
  815  *
  816  * Requested by Sam Roberts <vieuxtech@gmail.com>.
  817  */
  818 #define DLT_WIHART      223
  819 
  820 /*
  821  * Fibre Channel FC-2 frames, beginning with a Frame_Header.
  822  * Requested by Kahou Lei <kahou82@gmail.com>.
  823  */
  824 #define DLT_FC_2        224
  825 
  826 /*
  827  * Fibre Channel FC-2 frames, beginning with an encoding of the
  828  * SOF, and ending with an encoding of the EOF.
  829  *
  830  * The encodings represent the frame delimiters as 4-byte sequences
  831  * representing the corresponding ordered sets, with K28.5
  832  * represented as 0xBC, and the D symbols as the corresponding
  833  * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2,
  834  * is represented as 0xBC 0xB5 0x55 0x55.
  835  *
  836  * Requested by Kahou Lei <kahou82@gmail.com>.
  837  */
  838 #define DLT_FC_2_WITH_FRAME_DELIMS  225
  839 
  840 /*
  841  * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>.
  842  *
  843  * The pseudo-header starts with a one-byte version number; for version 2,
  844  * the pseudo-header is:
  845  *
  846  * struct dl_ipnetinfo {
  847  *     u_int8_t   dli_version;
  848  *     u_int8_t   dli_family;
  849  *     u_int16_t  dli_htype;
  850  *     u_int32_t  dli_pktlen;
  851  *     u_int32_t  dli_ifindex;
  852  *     u_int32_t  dli_grifindex;
  853  *     u_int32_t  dli_zsrc;
  854  *     u_int32_t  dli_zdst;
  855  * };
  856  *
  857  * dli_version is 2 for the current version of the pseudo-header.
  858  *
  859  * dli_family is a Solaris address family value, so it's 2 for IPv4
  860  * and 26 for IPv6.
  861  *
  862  * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing
  863  * packets, and 2 for packets arriving from another zone on the same
  864  * machine.
  865  *
  866  * dli_pktlen is the length of the packet data following the pseudo-header
  867  * (so the captured length minus dli_pktlen is the length of the
  868  * pseudo-header, assuming the entire pseudo-header was captured).
  869  *
  870  * dli_ifindex is the interface index of the interface on which the
  871  * packet arrived.
  872  *
  873  * dli_grifindex is the group interface index number (for IPMP interfaces).
  874  *
  875  * dli_zsrc is the zone identifier for the source of the packet.
  876  *
  877  * dli_zdst is the zone identifier for the destination of the packet.
  878  *
  879  * A zone number of 0 is the global zone; a zone number of 0xffffffff
  880  * means that the packet arrived from another host on the network, not
  881  * from another zone on the same machine.
  882  *
  883  * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates
  884  * which of those it is.
  885  */
  886 #define DLT_IPNET           226
  887 
  888 /*
  889  * CAN (Controller Area Network) frames, with a pseudo-header as supplied
  890  * by Linux SocketCAN.  See Documentation/networking/can.txt in the Linux
  891  * source.
  892  *
  893  * Requested by Felix Obenhuber <felix@obenhuber.de>.
  894  */
  895 #define DLT_CAN_SOCKETCAN       227
  896 
  897 /*
  898  * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies
  899  * whether it's v4 or v6.  Requested by Darren Reed <Darren.Reed@Sun.COM>.
  900  */
  901 #define DLT_IPV4            228
  902 #define DLT_IPV6            229
  903 
  904 /*
  905  * DLT and savefile link type values are split into a class and
  906  * a member of that class.  A class value of 0 indicates a regular
  907  * DLT_/LINKTYPE_ value.
  908  */
  909 #define DLT_CLASS(x)        ((x) & 0x03ff0000)
  910 
  911 /*
  912  * NetBSD-specific generic "raw" link type.  The class value indicates
  913  * that this is the generic raw type, and the lower 16 bits are the
  914  * address family we're dealing with.  Those values are NetBSD-specific;
  915  * do not assume that they correspond to AF_ values for your operating
  916  * system.
  917  */
  918 #define DLT_CLASS_NETBSD_RAWAF  0x02240000
  919 #define DLT_NETBSD_RAWAF(af)    (DLT_CLASS_NETBSD_RAWAF | (af))
  920 #define DLT_NETBSD_RAWAF_AF(x)  ((x) & 0x0000ffff)
  921 #define DLT_IS_NETBSD_RAWAF(x)  (DLT_CLASS(x) == DLT_CLASS_NETBSD_RAWAF)
  922 
  923 #endif /* _SFBPF_DLT_H */