Guy Harris
changed
bug 12329
| What |
Removed |
Added |
| Status |
UNCONFIRMED
|
CONFIRMED
|
| Hardware |
x86
|
All
|
| Ever confirmed |
|
1
|
Comment # 1
on bug 12329
from Guy Harris
(In reply to luto from comment #0)
> Wireshark can provide this information for "cooked" captures, but cooked
> captures are rare and inconvenient, and the information is buried a couple
> levels deep in the dissector.
>
> On Linux (at least all recent kernels, and I suspect it's true on all
> kernels ever), recvfrom and recvmsg on an AF_PACKET socket gives a
> sockaddr_ll. That sockaddr_ll's sll_pkttype field is valid. This works
> even in raw mode (I just tried it).
>
> Please consider recording this information and displaying it in a column.
We can only record the information if it's supplied to us, and currently
libpcap/WinPcap doesn't supply it (some OSes, such as Linux, supply it to
libpcap, but libpcap doesn't currently supply it to programs using it).
So this would require changes to libpcap in order to provide it for non-cooked
captures. libpcap/WinPcap will be changed in the future to support providing
additional information, in a pcapng-style format.
This would also require changes to Wireshark, to get the direction information
from a pcapng file (there's no place to put it in a pcap file). This bug will
be the bug to track those changes.
As for displaying it in a column, that will probably be done with custom
columns - there would be a frame.{something} field to get the direction, which
could be used as a custom column. Technically, that would be a change to
libwireshark, but there's no way to mark a bug as being for both libwiretap
*and* libwireshark, so I'll just leave this as a libwiretap bug.
You are receiving this mail because:
- You are watching all bug changes.