Ethereal-users: Re: [Ethereal-users] OT: How does ethereal/libpcap determine the layer 3 type?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 3 Sep 2003 10:53:35 -0700

On Wednesday, September 3, 2003, at 7:02 AM, darren wrote:

I can understand that libpcap inserts the LCS header in front if it gets a new ARP type that does not match its list...just wondering which command is it exactly that libpcap use to fetch the L3 protocol type from the kernel
network stack?

"recvfrom()". Conveniently, that's the same call it uses to fetch the packet data; on a PF_PACKET socket, the "from" address returned by "recvfrom()" is a "struct sockaddr_ll" that contains, among other things, a "Physical layer protocol" value that's an Ethernet type value for most packets, or a special value for Ethernet packets with 802.2 headers or with raw IPX-over-802.3.

See the "packet(7)" man page.

Any reason why my card driver strips the L2 header away when I specify the
encapsulation type?

I don't know for certain, but it could be that the driver writer had no clue what "mac.raw" is for in a skbuff structure. Drivers *SHOULD* be setting "mac.raw" to point to the beginning of the raw packet data, but perhaps some driver writers Don't Get It and set it to point to the encapsulated data.

What type of card is this?  (Vendor name.)  And what driver does it use?