[Guy Harris <guy@xxxxxxxxxxxx>]

On Nov 11, 2003, at 12:36 PM, Brian Ginsbach wrote:

> The following changes fix the decoding snoop loopback captures from
> IRIX and UNICOS/mp.  With these changes loopback captures will be
> decoded rather than show up as "Raw packet data".

Well, that appears to answer the question in a comment in libpcap's 
pcap-snoop.c:

        } else if (strncmp("lo", device, 2) == 0) {
                p->linktype = DLT_NULL;
                ll_hdrlen = 4;  /* is this just like BSD's loopback 
device? */

The answer appears to be "not exactly".

You might want to look at doing a similar fix for tcpdump (more stuff 
in "null_if_print()" in "print-null.c", where it sets "family"), and do 
the appropriate stuff in libpcap (you'd have to generate code to check 
for both BSD-style and IRIX-style headers - or, alternatively, tweak 
"pcap-snoop.c" so that, in "pcap_read_snoop()", if capturing on a 
DLT_NULL device it converts the first 4 bytes of the packet it read to 
look like a BSD-style header).