Home | History | Annotate | Download | only in pcap
      1 /*-
      2  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
      3  *	The Regents of the University of California.  All rights reserved.
      4  *
      5  * This code is derived from the Stanford/CMU enet packet filter,
      6  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
      7  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
      8  * Berkeley Laboratory.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  * 3. All advertising materials mentioning features or use of this software
     19  *    must display the following acknowledgement:
     20  *      This product includes software developed by the University of
     21  *      California, Berkeley and its contributors.
     22  * 4. Neither the name of the University nor the names of its contributors
     23  *    may be used to endorse or promote products derived from this software
     24  *    without specific prior written permission.
     25  *
     26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     36  * SUCH DAMAGE.
     37  *
     38  *      @(#)bpf.h       7.1 (Berkeley) 5/7/91
     39  *
     40  * @(#) $Header: /tcpdump/master/libpcap/pcap/bpf.h,v 1.32 2008-12-23 20:13:29 guy Exp $ (LBL)
     41  */
     42 
     43 /*
     44  * This is libpcap's cut-down version of bpf.h; it includes only
     45  * the stuff needed for the code generator and the userland BPF
     46  * interpreter, and the libpcap APIs for setting filters, etc..
     47  *
     48  * "pcap-bpf.c" will include the native OS version, as it deals with
     49  * the OS's BPF implementation.
     50  *
     51  * At least two programs found by Google Code Search explicitly includes
     52  * <pcap/bpf.h> (even though <pcap.h>/<pcap/pcap.h> includes it for you),
     53  * so moving that stuff to <pcap/pcap.h> would break the build for some
     54  * programs.
     55  */
     56 
     57 /*
     58  * If we've already included <net/bpf.h>, don't re-define this stuff.
     59  * We assume BSD-style multiple-include protection in <net/bpf.h>,
     60  * which is true of all but the oldest versions of FreeBSD and NetBSD,
     61  * or Tru64 UNIX-style multiple-include protection (or, at least,
     62  * Tru64 UNIX 5.x-style; I don't have earlier versions available to check),
     63  * or AIX-style multiple-include protection (or, at least, AIX 5.x-style;
     64  * I don't have earlier versions available to check).
     65  *
     66  * We do not check for BPF_MAJOR_VERSION, as that's defined by
     67  * <linux/filter.h>, which is directly or indirectly included in some
     68  * programs that also include pcap.h, and <linux/filter.h> doesn't
     69  * define stuff we need.
     70  *
     71  * This also provides our own multiple-include protection.
     72  */
     73 #if !defined(_NET_BPF_H_) && !defined(_BPF_H_) && !defined(_H_BPF) && !defined(lib_pcap_bpf_h)
     74 #define lib_pcap_bpf_h
     75 
     76 #ifdef __cplusplus
     77 extern "C" {
     78 #endif
     79 
     80 /* BSD style release date */
     81 #define BPF_RELEASE 199606
     82 
     83 #ifdef MSDOS /* must be 32-bit */
     84 typedef long          bpf_int32;
     85 typedef unsigned long bpf_u_int32;
     86 #else
     87 typedef	int bpf_int32;
     88 typedef	u_int bpf_u_int32;
     89 #endif
     90 
     91 /*
     92  * Alignment macros.  BPF_WORDALIGN rounds up to the next
     93  * even multiple of BPF_ALIGNMENT.
     94  *
     95  * Tcpdump's print-pflog.c uses this, so we define it here.
     96  */
     97 #ifndef __NetBSD__
     98 #define BPF_ALIGNMENT sizeof(bpf_int32)
     99 #else
    100 #define BPF_ALIGNMENT sizeof(long)
    101 #endif
    102 #define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
    103 
    104 /*
    105  * Structure for "pcap_compile()", "pcap_setfilter()", etc..
    106  */
    107 struct bpf_program {
    108 	u_int bf_len;
    109 	struct bpf_insn *bf_insns;
    110 };
    111 
    112 /*
    113  * Link-layer header type codes.
    114  *
    115  * Do *NOT* add new values to this list without asking
    116  * "tcpdump-workers (at) lists.tcpdump.org" for a value.  Otherwise, you run
    117  * the risk of using a value that's already being used for some other
    118  * purpose, and of having tools that read libpcap-format captures not
    119  * being able to handle captures with your new DLT_ value, with no hope
    120  * that they will ever be changed to do so (as that would destroy their
    121  * ability to read captures using that value for that other purpose).
    122  *
    123  * See
    124  *
    125  *	http://www.tcpdump.org/linktypes.html
    126  *
    127  * for detailed descriptions of some of these link-layer header types.
    128  */
    129 
    130 /*
    131  * These are the types that are the same on all platforms, and that
    132  * have been defined by <net/bpf.h> for ages.
    133  */
    134 #define DLT_NULL	0	/* BSD loopback encapsulation */
    135 #define DLT_EN10MB	1	/* Ethernet (10Mb) */
    136 #define DLT_EN3MB	2	/* Experimental Ethernet (3Mb) */
    137 #define DLT_AX25	3	/* Amateur Radio AX.25 */
    138 #define DLT_PRONET	4	/* Proteon ProNET Token Ring */
    139 #define DLT_CHAOS	5	/* Chaos */
    140 #define DLT_IEEE802	6	/* 802.5 Token Ring */
    141 #define DLT_ARCNET	7	/* ARCNET, with BSD-style header */
    142 #define DLT_SLIP	8	/* Serial Line IP */
    143 #define DLT_PPP		9	/* Point-to-point Protocol */
    144 #define DLT_FDDI	10	/* FDDI */
    145 
    146 /*
    147  * These are types that are different on some platforms, and that
    148  * have been defined by <net/bpf.h> for ages.  We use #ifdefs to
    149  * detect the BSDs that define them differently from the traditional
    150  * libpcap <net/bpf.h>
    151  *
    152  * XXX - DLT_ATM_RFC1483 is 13 in BSD/OS, and DLT_RAW is 14 in BSD/OS,
    153  * but I don't know what the right #define is for BSD/OS.
    154  */
    155 #define DLT_ATM_RFC1483	11	/* LLC-encapsulated ATM */
    156 
    157 #ifdef __OpenBSD__
    158 #define DLT_RAW		14	/* raw IP */
    159 #else
    160 #define DLT_RAW		12	/* raw IP */
    161 #endif
    162 
    163 /*
    164  * Given that the only OS that currently generates BSD/OS SLIP or PPP
    165  * is, well, BSD/OS, arguably everybody should have chosen its values
    166  * for DLT_SLIP_BSDOS and DLT_PPP_BSDOS, which are 15 and 16, but they
    167  * didn't.  So it goes.
    168  */
    169 #if defined(__NetBSD__) || defined(__FreeBSD__)
    170 #ifndef DLT_SLIP_BSDOS
    171 #define DLT_SLIP_BSDOS	13	/* BSD/OS Serial Line IP */
    172 #define DLT_PPP_BSDOS	14	/* BSD/OS Point-to-point Protocol */
    173 #endif
    174 #else
    175 #define DLT_SLIP_BSDOS	15	/* BSD/OS Serial Line IP */
    176 #define DLT_PPP_BSDOS	16	/* BSD/OS Point-to-point Protocol */
    177 #endif
    178 
    179 /*
    180  * 17 was used for DLT_PFLOG in OpenBSD; it no longer is.
    181  *
    182  * It was DLT_LANE8023 in SuSE 6.3, so we defined LINKTYPE_PFLOG
    183  * as 117 so that pflog captures would use a link-layer header type
    184  * value that didn't collide with any other values.  On all
    185  * platforms other than OpenBSD, we defined DLT_PFLOG as 117,
    186  * and we mapped between LINKTYPE_PFLOG and DLT_PFLOG.
    187  *
    188  * OpenBSD eventually switched to using 117 for DLT_PFLOG as well.
    189  *
    190  * Don't use 17 for anything else.
    191  */
    192 
    193 /*
    194  * 18 is used for DLT_PFSYNC in OpenBSD, NetBSD, DragonFly BSD and
    195  * Mac OS X; don't use it for anything else.  (FreeBSD uses 121,
    196  * which collides with DLT_HHDLC, even though it doesn't use 18
    197  * for anything and doesn't appear to have ever used it for anything.)
    198  *
    199  * We define it as 18 on those platforms; it is, unfortunately, used
    200  * for DLT_CIP in Suse 6.3, so we don't define it as DLT_PFSYNC
    201  * in general.  As the packet format for it, like that for
    202  * DLT_PFLOG, is not only OS-dependent but OS-version-dependent,
    203  * we don't support printing it in tcpdump except on OSes that
    204  * have the relevant header files, so it's not that useful on
    205  * other platforms.
    206  */
    207 #if defined(__OpenBSD__) || defined(__NetBSD__) || defined(__DragonFly__) || defined(__APPLE__)
    208 #define DLT_PFSYNC	18
    209 #endif
    210 
    211 #define DLT_ATM_CLIP	19	/* Linux Classical-IP over ATM */
    212 
    213 /*
    214  * Apparently Redback uses this for its SmartEdge 400/800.  I hope
    215  * nobody else decided to use it, too.
    216  */
    217 #define DLT_REDBACK_SMARTEDGE	32
    218 
    219 /*
    220  * These values are defined by NetBSD; other platforms should refrain from
    221  * using them for other purposes, so that NetBSD savefiles with link
    222  * types of 50 or 51 can be read as this type on all platforms.
    223  */
    224 #define DLT_PPP_SERIAL	50	/* PPP over serial with HDLC encapsulation */
    225 #define DLT_PPP_ETHER	51	/* PPP over Ethernet */
    226 
    227 /*
    228  * The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses
    229  * a link-layer type of 99 for the tcpdump it supplies.  The link-layer
    230  * header has 6 bytes of unknown data, something that appears to be an
    231  * Ethernet type, and 36 bytes that appear to be 0 in at least one capture
    232  * I've seen.
    233  */
    234 #define DLT_SYMANTEC_FIREWALL	99
    235 
    236 /*
    237  * Values between 100 and 103 are used in capture file headers as
    238  * link-layer header type LINKTYPE_ values corresponding to DLT_ types
    239  * that differ between platforms; don't use those values for new DLT_
    240  * new types.
    241  */
    242 
    243 /*
    244  * Values starting with 104 are used for newly-assigned link-layer
    245  * header type values; for those link-layer header types, the DLT_
    246  * value returned by pcap_datalink() and passed to pcap_open_dead(),
    247  * and the LINKTYPE_ value that appears in capture files, are the
    248  * same.
    249  *
    250  * DLT_MATCHING_MIN is the lowest such value; DLT_MATCHING_MAX is
    251  * the highest such value.
    252  */
    253 #define DLT_MATCHING_MIN	104
    254 
    255 /*
    256  * This value was defined by libpcap 0.5; platforms that have defined
    257  * it with a different value should define it here with that value -
    258  * a link type of 104 in a save file will be mapped to DLT_C_HDLC,
    259  * whatever value that happens to be, so programs will correctly
    260  * handle files with that link type regardless of the value of
    261  * DLT_C_HDLC.
    262  *
    263  * The name DLT_C_HDLC was used by BSD/OS; we use that name for source
    264  * compatibility with programs written for BSD/OS.
    265  *
    266  * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
    267  * for source compatibility with programs written for libpcap 0.5.
    268  */
    269 #define DLT_C_HDLC	104	/* Cisco HDLC */
    270 #define DLT_CHDLC	DLT_C_HDLC
    271 
    272 #define DLT_IEEE802_11	105	/* IEEE 802.11 wireless */
    273 
    274 /*
    275  * 106 is reserved for Linux Classical IP over ATM; it's like DLT_RAW,
    276  * except when it isn't.  (I.e., sometimes it's just raw IP, and
    277  * sometimes it isn't.)  We currently handle it as DLT_LINUX_SLL,
    278  * so that we don't have to worry about the link-layer header.)
    279  */
    280 
    281 /*
    282  * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides
    283  * with other values.
    284  * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header
    285  * (DLCI, etc.).
    286  */
    287 #define DLT_FRELAY	107
    288 
    289 /*
    290  * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
    291  * that the AF_ type in the link-layer header is in network byte order.
    292  *
    293  * DLT_LOOP is 12 in OpenBSD, but that's DLT_RAW in other OSes, so
    294  * we don't use 12 for it in OSes other than OpenBSD.
    295  */
    296 #ifdef __OpenBSD__
    297 #define DLT_LOOP	12
    298 #else
    299 #define DLT_LOOP	108
    300 #endif
    301 
    302 /*
    303  * Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's
    304  * DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other
    305  * than OpenBSD.
    306  */
    307 #ifdef __OpenBSD__
    308 #define DLT_ENC		13
    309 #else
    310 #define DLT_ENC		109
    311 #endif
    312 
    313 /*
    314  * Values between 110 and 112 are reserved for use in capture file headers
    315  * as link-layer types corresponding to DLT_ types that might differ
    316  * between platforms; don't use those values for new DLT_ types
    317  * other than the corresponding DLT_ types.
    318  */
    319 
    320 /*
    321  * This is for Linux cooked sockets.
    322  */
    323 #define DLT_LINUX_SLL	113
    324 
    325 /*
    326  * Apple LocalTalk hardware.
    327  */
    328 #define DLT_LTALK	114
    329 
    330 /*
    331  * Acorn Econet.
    332  */
    333 #define DLT_ECONET	115
    334 
    335 /*
    336  * Reserved for use with OpenBSD ipfilter.
    337  */
    338 #define DLT_IPFILTER	116
    339 
    340 /*
    341  * OpenBSD DLT_PFLOG.
    342  */
    343 #define DLT_PFLOG	117
    344 
    345 /*
    346  * Registered for Cisco-internal use.
    347  */
    348 #define DLT_CISCO_IOS	118
    349 
    350 /*
    351  * For 802.11 cards using the Prism II chips, with a link-layer
    352  * header including Prism monitor mode information plus an 802.11
    353  * header.
    354  */
    355 #define DLT_PRISM_HEADER	119
    356 
    357 /*
    358  * Reserved for Aironet 802.11 cards, with an Aironet link-layer header
    359  * (see Doug Ambrisko's FreeBSD patches).
    360  */
    361 #define DLT_AIRONET_HEADER	120
    362 
    363 /*
    364  * Sigh.
    365  *
    366  * This was reserved for Siemens HiPath HDLC on 2002-01-25, as
    367  * requested by Tomas Kukosa.
    368  *
    369  * On 2004-02-25, a FreeBSD checkin to sys/net/bpf.h was made that
    370  * assigned 121 as DLT_PFSYNC.  Its libpcap does DLT_ <-> LINKTYPE_
    371  * mapping, so it probably supports capturing on the pfsync device
    372  * but not saving the captured data to a pcap file.
    373  *
    374  * OpenBSD, from which pf came, however, uses 18 for DLT_PFSYNC;
    375  * their libpcap does no DLT_ <-> LINKTYPE_ mapping, so it would
    376  * use 18 in pcap files as well.
    377  *
    378  * NetBSD and DragonFly BSD also use 18 for DLT_PFSYNC; their
    379  * libpcaps do DLT_ <-> LINKTYPE_ mapping, and neither has an entry
    380  * for DLT_PFSYNC, so it might not be able to write out dump files
    381  * with 18 as the link-layer header type.  (Earlier versions might
    382  * not have done mapping, in which case they'd work the same way
    383  * OpenBSD does.)
    384  *
    385  * Mac OS X defines it as 18, but doesn't appear to use it as of
    386  * Mac OS X 10.7.3.  Its libpcap does DLT_ <-> LINKTYPE_ mapping.
    387  *
    388  * We'll define DLT_PFSYNC as 121 on FreeBSD and define it as 18 on
    389  * all other platforms.  We'll define DLT_HHDLC as 121 on everything
    390  * except for FreeBSD; anybody who wants to compile, on FreeBSD, code
    391  * that uses DLT_HHDLC is out of luck.
    392  *
    393  * We'll define LINKTYPE_PFSYNC as 18, *even on FreeBSD*, and map
    394  * it, so that savefiles won't use 121 for PFSYNC - they'll all
    395  * use 18.  Code that uses pcap_datalink() to determine the link-layer
    396  * header type of a savefile won't, when built and run on FreeBSD,
    397  * be able to distinguish between LINKTYPE_PFSYNC and LINKTYPE_HHDLC
    398  * capture files; code that doesn't, such as the code in Wireshark,
    399  * will be able to distinguish between them.
    400  */
    401 #ifdef __FreeBSD__
    402 #define DLT_PFSYNC		121
    403 #else
    404 #define DLT_HHDLC		121
    405 #endif
    406 
    407 /*
    408  * This is for RFC 2625 IP-over-Fibre Channel.
    409  *
    410  * This is not for use with raw Fibre Channel, where the link-layer
    411  * header starts with a Fibre Channel frame header; it's for IP-over-FC,
    412  * where the link-layer header starts with an RFC 2625 Network_Header
    413  * field.
    414  */
    415 #define DLT_IP_OVER_FC		122
    416 
    417 /*
    418  * This is for Full Frontal ATM on Solaris with SunATM, with a
    419  * pseudo-header followed by an AALn PDU.
    420  *
    421  * There may be other forms of Full Frontal ATM on other OSes,
    422  * with different pseudo-headers.
    423  *
    424  * If ATM software returns a pseudo-header with VPI/VCI information
    425  * (and, ideally, packet type information, e.g. signalling, ILMI,
    426  * LANE, LLC-multiplexed traffic, etc.), it should not use
    427  * DLT_ATM_RFC1483, but should get a new DLT_ value, so tcpdump
    428  * and the like don't have to infer the presence or absence of a
    429  * pseudo-header and the form of the pseudo-header.
    430  */
    431 #define DLT_SUNATM		123	/* Solaris+SunATM */
    432 
    433 /*
    434  * Reserved as per request from Kent Dahlgren <kent (at) praesum.com>
    435  * for private use.
    436  */
    437 #define DLT_RIO                 124     /* RapidIO */
    438 #define DLT_PCI_EXP             125     /* PCI Express */
    439 #define DLT_AURORA              126     /* Xilinx Aurora link layer */
    440 
    441 /*
    442  * Header for 802.11 plus a number of bits of link-layer information
    443  * including radio information, used by some recent BSD drivers as
    444  * well as the madwifi Atheros driver for Linux.
    445  */
    446 #define DLT_IEEE802_11_RADIO	127	/* 802.11 plus radiotap radio header */
    447 
    448 /*
    449  * Reserved for the TZSP encapsulation, as per request from
    450  * Chris Waters <chris.waters (at) networkchemistry.com>
    451  * TZSP is a generic encapsulation for any other link type,
    452  * which includes a means to include meta-information
    453  * with the packet, e.g. signal strength and channel
    454  * for 802.11 packets.
    455  */
    456 #define DLT_TZSP                128     /* Tazmen Sniffer Protocol */
    457 
    458 /*
    459  * BSD's ARCNET headers have the source host, destination host,
    460  * and type at the beginning of the packet; that's what's handed
    461  * up to userland via BPF.
    462  *
    463  * Linux's ARCNET headers, however, have a 2-byte offset field
    464  * between the host IDs and the type; that's what's handed up
    465  * to userland via PF_PACKET sockets.
    466  *
    467  * We therefore have to have separate DLT_ values for them.
    468  */
    469 #define DLT_ARCNET_LINUX	129	/* ARCNET */
    470 
    471 /*
    472  * Juniper-private data link types, as per request from
    473  * Hannes Gredler <hannes (at) juniper.net>.  The DLT_s are used
    474  * for passing on chassis-internal metainformation such as
    475  * QOS profiles, etc..
    476  */
    477 #define DLT_JUNIPER_MLPPP       130
    478 #define DLT_JUNIPER_MLFR        131
    479 #define DLT_JUNIPER_ES          132
    480 #define DLT_JUNIPER_GGSN        133
    481 #define DLT_JUNIPER_MFR         134
    482 #define DLT_JUNIPER_ATM2        135
    483 #define DLT_JUNIPER_SERVICES    136
    484 #define DLT_JUNIPER_ATM1        137
    485 
    486 /*
    487  * Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund
    488  * <dieter (at) apple.com>.  The header that's presented is an Ethernet-like
    489  * header:
    490  *
    491  *	#define FIREWIRE_EUI64_LEN	8
    492  *	struct firewire_header {
    493  *		u_char  firewire_dhost[FIREWIRE_EUI64_LEN];
    494  *		u_char  firewire_shost[FIREWIRE_EUI64_LEN];
    495  *		u_short firewire_type;
    496  *	};
    497  *
    498  * with "firewire_type" being an Ethernet type value, rather than,
    499  * for example, raw GASP frames being handed up.
    500  */
    501 #define DLT_APPLE_IP_OVER_IEEE1394	138
    502 
    503 /*
    504  * Various SS7 encapsulations, as per a request from Jeff Morriss
    505  * <jeff.morriss[AT]ulticom.com> and subsequent discussions.
    506  */
    507 #define DLT_MTP2_WITH_PHDR	139	/* pseudo-header with various info, followed by MTP2 */
    508 #define DLT_MTP2		140	/* MTP2, without pseudo-header */
    509 #define DLT_MTP3		141	/* MTP3, without pseudo-header or MTP2 */
    510 #define DLT_SCCP		142	/* SCCP, without pseudo-header or MTP2 or MTP3 */
    511 
    512 /*
    513  * DOCSIS MAC frames.
    514  */
    515 #define DLT_DOCSIS		143
    516 
    517 /*
    518  * Linux-IrDA packets. Protocol defined at http://www.irda.org.
    519  * Those packets include IrLAP headers and above (IrLMP...), but
    520  * don't include Phy framing (SOF/EOF/CRC & byte stuffing), because Phy
    521  * framing can be handled by the hardware and depend on the bitrate.
    522  * This is exactly the format you would get capturing on a Linux-IrDA
    523  * interface (irdaX), but not on a raw serial port.
    524  * Note the capture is done in "Linux-cooked" mode, so each packet include
    525  * a fake packet header (struct sll_header). This is because IrDA packet
    526  * decoding is dependant on the direction of the packet (incomming or
    527  * outgoing).
    528  * When/if other platform implement IrDA capture, we may revisit the
    529  * issue and define a real DLT_IRDA...
    530  * Jean II
    531  */
    532 #define DLT_LINUX_IRDA		144
    533 
    534 /*
    535  * Reserved for IBM SP switch and IBM Next Federation switch.
    536  */
    537 #define DLT_IBM_SP		145
    538 #define DLT_IBM_SN		146
    539 
    540 /*
    541  * Reserved for private use.  If you have some link-layer header type
    542  * that you want to use within your organization, with the capture files
    543  * using that link-layer header type not ever be sent outside your
    544  * organization, you can use these values.
    545  *
    546  * No libpcap release will use these for any purpose, nor will any
    547  * tcpdump release use them, either.
    548  *
    549  * Do *NOT* use these in capture files that you expect anybody not using
    550  * your private versions of capture-file-reading tools to read; in
    551  * particular, do *NOT* use them in products, otherwise you may find that
    552  * people won't be able to use tcpdump, or snort, or Ethereal, or... to
    553  * read capture files from your firewall/intrusion detection/traffic
    554  * monitoring/etc. appliance, or whatever product uses that DLT_ value,
    555  * and you may also find that the developers of those applications will
    556  * not accept patches to let them read those files.
    557  *
    558  * Also, do not use them if somebody might send you a capture using them
    559  * for *their* private type and tools using them for *your* private type
    560  * would have to read them.
    561  *
    562  * Instead, ask "tcpdump-workers (at) lists.tcpdump.org" for a new DLT_ value,
    563  * as per the comment above, and use the type you're given.
    564  */
    565 #define DLT_USER0		147
    566 #define DLT_USER1		148
    567 #define DLT_USER2		149
    568 #define DLT_USER3		150
    569 #define DLT_USER4		151
    570 #define DLT_USER5		152
    571 #define DLT_USER6		153
    572 #define DLT_USER7		154
    573 #define DLT_USER8		155
    574 #define DLT_USER9		156
    575 #define DLT_USER10		157
    576 #define DLT_USER11		158
    577 #define DLT_USER12		159
    578 #define DLT_USER13		160
    579 #define DLT_USER14		161
    580 #define DLT_USER15		162
    581 
    582 /*
    583  * For future use with 802.11 captures - defined by AbsoluteValue
    584  * Systems to store a number of bits of link-layer information
    585  * including radio information:
    586  *
    587  *	http://www.shaftnet.org/~pizza/software/capturefrm.txt
    588  *
    589  * but it might be used by some non-AVS drivers now or in the
    590  * future.
    591  */
    592 #define DLT_IEEE802_11_RADIO_AVS 163	/* 802.11 plus AVS radio header */
    593 
    594 /*
    595  * Juniper-private data link type, as per request from
    596  * Hannes Gredler <hannes (at) juniper.net>.  The DLT_s are used
    597  * for passing on chassis-internal metainformation such as
    598  * QOS profiles, etc..
    599  */
    600 #define DLT_JUNIPER_MONITOR     164
    601 
    602 /*
    603  * BACnet MS/TP frames.
    604  */
    605 #define DLT_BACNET_MS_TP	165
    606 
    607 /*
    608  * Another PPP variant as per request from Karsten Keil <kkeil (at) suse.de>.
    609  *
    610  * This is used in some OSes to allow a kernel socket filter to distinguish
    611  * between incoming and outgoing packets, on a socket intended to
    612  * supply pppd with outgoing packets so it can do dial-on-demand and
    613  * hangup-on-lack-of-demand; incoming packets are filtered out so they
    614  * don't cause pppd to hold the connection up (you don't want random
    615  * input packets such as port scans, packets from old lost connections,
    616  * etc. to force the connection to stay up).
    617  *
    618  * The first byte of the PPP header (0xff03) is modified to accomodate
    619  * the direction - 0x00 = IN, 0x01 = OUT.
    620  */
    621 #define DLT_PPP_PPPD		166
    622 
    623 /*
    624  * Names for backwards compatibility with older versions of some PPP
    625  * software; new software should use DLT_PPP_PPPD.
    626  */
    627 #define DLT_PPP_WITH_DIRECTION	DLT_PPP_PPPD
    628 #define DLT_LINUX_PPP_WITHDIRECTION	DLT_PPP_PPPD
    629 
    630 /*
    631  * Juniper-private data link type, as per request from
    632  * Hannes Gredler <hannes (at) juniper.net>.  The DLT_s are used
    633  * for passing on chassis-internal metainformation such as
    634  * QOS profiles, cookies, etc..
    635  */
    636 #define DLT_JUNIPER_PPPOE       167
    637 #define DLT_JUNIPER_PPPOE_ATM   168
    638 
    639 #define DLT_GPRS_LLC		169	/* GPRS LLC */
    640 #define DLT_GPF_T		170	/* GPF-T (ITU-T G.7041/Y.1303) */
    641 #define DLT_GPF_F		171	/* GPF-F (ITU-T G.7041/Y.1303) */
    642 
    643 /*
    644  * Requested by Oolan Zimmer <oz (at) gcom.com> for use in Gcom's T1/E1 line
    645  * monitoring equipment.
    646  */
    647 #define DLT_GCOM_T1E1		172
    648 #define DLT_GCOM_SERIAL		173
    649 
    650 /*
    651  * Juniper-private data link type, as per request from
    652  * Hannes Gredler <hannes (at) juniper.net>.  The DLT_ is used
    653  * for internal communication to Physical Interface Cards (PIC)
    654  */
    655 #define DLT_JUNIPER_PIC_PEER    174
    656 
    657 /*
    658  * Link types requested by Gregor Maier <gregor (at) endace.com> of Endace
    659  * Measurement Systems.  They add an ERF header (see
    660  * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of
    661  * the link-layer header.
    662  */
    663 #define DLT_ERF_ETH		175	/* Ethernet */
    664 #define DLT_ERF_POS		176	/* Packet-over-SONET */
    665 
    666 /*
    667  * Requested by Daniele Orlandi <daniele (at) orlandi.com> for raw LAPD
    668  * for vISDN (http://www.orlandi.com/visdn/).  Its link-layer header
    669  * includes additional information before the LAPD header, so it's
    670  * not necessarily a generic LAPD header.
    671  */
    672 #define DLT_LINUX_LAPD		177
    673 
    674 /*
    675  * Juniper-private data link type, as per request from
    676  * Hannes Gredler <hannes (at) juniper.net>.
    677  * The DLT_ are used for prepending meta-information
    678  * like interface index, interface name
    679  * before standard Ethernet, PPP, Frelay & C-HDLC Frames
    680  */
    681 #define DLT_JUNIPER_ETHER       178
    682 #define DLT_JUNIPER_PPP         179
    683 #define DLT_JUNIPER_FRELAY      180
    684 #define DLT_JUNIPER_CHDLC       181
    685 
    686 /*
    687  * Multi Link Frame Relay (FRF.16)
    688  */
    689 #define DLT_MFR                 182
    690 
    691 /*
    692  * Juniper-private data link type, as per request from
    693  * Hannes Gredler <hannes (at) juniper.net>.
    694  * The DLT_ is used for internal communication with a
    695  * voice Adapter Card (PIC)
    696  */
    697 #define DLT_JUNIPER_VP          183
    698 
    699 /*
    700  * Arinc 429 frames.
    701  * DLT_ requested by Gianluca Varenni <gianluca.varenni (at) cacetech.com>.
    702  * Every frame contains a 32bit A429 label.
    703  * More documentation on Arinc 429 can be found at
    704  * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
    705  */
    706 #define DLT_A429                184
    707 
    708 /*
    709  * Arinc 653 Interpartition Communication messages.
    710  * DLT_ requested by Gianluca Varenni <gianluca.varenni (at) cacetech.com>.
    711  * Please refer to the A653-1 standard for more information.
    712  */
    713 #define DLT_A653_ICM            185
    714 
    715 /*
    716  * USB packets, beginning with a USB setup header; requested by
    717  * Paolo Abeni <paolo.abeni (at) email.it>.
    718  */
    719 #define DLT_USB			186
    720 
    721 /*
    722  * Bluetooth HCI UART transport layer (part H:4); requested by
    723  * Paolo Abeni.
    724  */
    725 #define DLT_BLUETOOTH_HCI_H4	187
    726 
    727 /*
    728  * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
    729  * <cruz_petagay (at) bah.com>.
    730  */
    731 #define DLT_IEEE802_16_MAC_CPS	188
    732 
    733 /*
    734  * USB packets, beginning with a Linux USB header; requested by
    735  * Paolo Abeni <paolo.abeni (at) email.it>.
    736  */
    737 #define DLT_USB_LINUX		189
    738 
    739 /*
    740  * Controller Area Network (CAN) v. 2.0B packets.
    741  * DLT_ requested by Gianluca Varenni <gianluca.varenni (at) cacetech.com>.
    742  * Used to dump CAN packets coming from a CAN Vector board.
    743  * More documentation on the CAN v2.0B frames can be found at
    744  * http://www.can-cia.org/downloads/?269
    745  */
    746 #define DLT_CAN20B              190
    747 
    748 /*
    749  * IEEE 802.15.4, with address fields padded, as is done by Linux
    750  * drivers; requested by Juergen Schimmer.
    751  */
    752 #define DLT_IEEE802_15_4_LINUX	191
    753 
    754 /*
    755  * Per Packet Information encapsulated packets.
    756  * DLT_ requested by Gianluca Varenni <gianluca.varenni (at) cacetech.com>.
    757  */
    758 #define DLT_PPI			192
    759 
    760 /*
    761  * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
    762  * requested by Charles Clancy.
    763  */
    764 #define DLT_IEEE802_16_MAC_CPS_RADIO	193
    765 
    766 /*
    767  * Juniper-private data link type, as per request from
    768  * Hannes Gredler <hannes (at) juniper.net>.
    769  * The DLT_ is used for internal communication with a
    770  * integrated service module (ISM).
    771  */
    772 #define DLT_JUNIPER_ISM         194
    773 
    774 /*
    775  * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
    776  * nothing); requested by Mikko Saarnivala <mikko.saarnivala (at) sensinode.com>.
    777  * For this one, we expect the FCS to be present at the end of the frame;
    778  * if the frame has no FCS, DLT_IEEE802_15_4_NOFCS should be used.
    779  */
    780 #define DLT_IEEE802_15_4	195
    781 
    782 /*
    783  * Various link-layer types, with a pseudo-header, for SITA
    784  * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew (at) gmail.com).
    785  */
    786 #define DLT_SITA		196
    787 
    788 /*
    789  * Various link-layer types, with a pseudo-header, for Endace DAG cards;
    790  * encapsulates Endace ERF records.  Requested by Stephen Donnelly
    791  * <stephen (at) endace.com>.
    792  */
    793 #define DLT_ERF			197
    794 
    795 /*
    796  * Special header prepended to Ethernet packets when capturing from a
    797  * u10 Networks board.  Requested by Phil Mulholland
    798  * <phil (at) u10networks.com>.
    799  */
    800 #define DLT_RAIF1		198
    801 
    802 /*
    803  * IPMB packet for IPMI, beginning with the I2C slave address, followed
    804  * by the netFn and LUN, etc..  Requested by Chanthy Toeung
    805  * <chanthy.toeung (at) ca.kontron.com>.
    806  */
    807 #define DLT_IPMB		199
    808 
    809 /*
    810  * Juniper-private data link type, as per request from
    811  * Hannes Gredler <hannes (at) juniper.net>.
    812  * The DLT_ is used for capturing data on a secure tunnel interface.
    813  */
    814 #define DLT_JUNIPER_ST          200
    815 
    816 /*
    817  * Bluetooth HCI UART transport layer (part H:4), with pseudo-header
    818  * that includes direction information; requested by Paolo Abeni.
    819  */
    820 #define DLT_BLUETOOTH_HCI_H4_WITH_PHDR	201
    821 
    822 /*
    823  * AX.25 packet with a 1-byte KISS header; see
    824  *
    825  *	http://www.ax25.net/kiss.htm
    826  *
    827  * as per Richard Stearn <richard (at) rns-stearn.demon.co.uk>.
    828  */
    829 #define DLT_AX25_KISS		202
    830 
    831 /*
    832  * LAPD packets from an ISDN channel, starting with the address field,
    833  * with no pseudo-header.
    834  * Requested by Varuna De Silva <varunax (at) gmail.com>.
    835  */
    836 #define DLT_LAPD		203
    837 
    838 /*
    839  * Variants of various link-layer headers, with a one-byte direction
    840  * pseudo-header prepended - zero means "received by this host",
    841  * non-zero (any non-zero value) means "sent by this host" - as per
    842  * Will Barker <w.barker (at) zen.co.uk>.
    843  */
    844 #define DLT_PPP_WITH_DIR	204	/* PPP - don't confuse with DLT_PPP_WITH_DIRECTION */
    845 #define DLT_C_HDLC_WITH_DIR	205	/* Cisco HDLC */
    846 #define DLT_FRELAY_WITH_DIR	206	/* Frame Relay */
    847 #define DLT_LAPB_WITH_DIR	207	/* LAPB */
    848 
    849 /*
    850  * 208 is reserved for an as-yet-unspecified proprietary link-layer
    851  * type, as requested by Will Barker.
    852  */
    853 
    854 /*
    855  * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman
    856  * <avn (at) pigeonpoint.com>.
    857  */
    858 #define DLT_IPMB_LINUX		209
    859 
    860 /*
    861  * FlexRay automotive bus - http://www.flexray.com/ - as requested
    862  * by Hannes Kaelber <hannes.kaelber (at) x2e.de>.
    863  */
    864 #define DLT_FLEXRAY		210
    865 
    866 /*
    867  * Media Oriented Systems Transport (MOST) bus for multimedia
    868  * transport - http://www.mostcooperation.com/ - as requested
    869  * by Hannes Kaelber <hannes.kaelber (at) x2e.de>.
    870  */
    871 #define DLT_MOST		211
    872 
    873 /*
    874  * Local Interconnect Network (LIN) bus for vehicle networks -
    875  * http://www.lin-subbus.org/ - as requested by Hannes Kaelber
    876  * <hannes.kaelber (at) x2e.de>.
    877  */
    878 #define DLT_LIN			212
    879 
    880 /*
    881  * X2E-private data link type used for serial line capture,
    882  * as requested by Hannes Kaelber <hannes.kaelber (at) x2e.de>.
    883  */
    884 #define DLT_X2E_SERIAL		213
    885 
    886 /*
    887  * X2E-private data link type used for the Xoraya data logger
    888  * family, as requested by Hannes Kaelber <hannes.kaelber (at) x2e.de>.
    889  */
    890 #define DLT_X2E_XORAYA		214
    891 
    892 /*
    893  * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
    894  * nothing), but with the PHY-level data for non-ASK PHYs (4 octets
    895  * of 0 as preamble, one octet of SFD, one octet of frame length+
    896  * reserved bit, and then the MAC-layer data, starting with the
    897  * frame control field).
    898  *
    899  * Requested by Max Filippov <jcmvbkbc (at) gmail.com>.
    900  */
    901 #define DLT_IEEE802_15_4_NONASK_PHY	215
    902 
    903 /*
    904  * David Gibson <david (at) gibson.dropbear.id.au> requested this for
    905  * captures from the Linux kernel /dev/input/eventN devices. This
    906  * is used to communicate keystrokes and mouse movements from the
    907  * Linux kernel to display systems, such as Xorg.
    908  */
    909 #define DLT_LINUX_EVDEV		216
    910 
    911 /*
    912  * GSM Um and Abis interfaces, preceded by a "gsmtap" header.
    913  *
    914  * Requested by Harald Welte <laforge (at) gnumonks.org>.
    915  */
    916 #define DLT_GSMTAP_UM		217
    917 #define DLT_GSMTAP_ABIS		218
    918 
    919 /*
    920  * MPLS, with an MPLS label as the link-layer header.
    921  * Requested by Michele Marchetto <michele (at) openbsd.org> on behalf
    922  * of OpenBSD.
    923  */
    924 #define DLT_MPLS		219
    925 
    926 /*
    927  * USB packets, beginning with a Linux USB header, with the USB header
    928  * padded to 64 bytes; required for memory-mapped access.
    929  */
    930 #define DLT_USB_LINUX_MMAPPED	220
    931 
    932 /*
    933  * DECT packets, with a pseudo-header; requested by
    934  * Matthias Wenzel <tcpdump (at) mazzoo.de>.
    935  */
    936 #define DLT_DECT		221
    937 
    938 /*
    939  * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1 (at) nasa.gov>
    940  * Date: Mon, 11 May 2009 11:18:30 -0500
    941  *
    942  * DLT_AOS. We need it for AOS Space Data Link Protocol.
    943  *   I have already written dissectors for but need an OK from
    944  *   legal before I can submit a patch.
    945  *
    946  */
    947 #define DLT_AOS                 222
    948 
    949 /*
    950  * Wireless HART (Highway Addressable Remote Transducer)
    951  * From the HART Communication Foundation
    952  * IES/PAS 62591
    953  *
    954  * Requested by Sam Roberts <vieuxtech (at) gmail.com>.
    955  */
    956 #define DLT_WIHART		223
    957 
    958 /*
    959  * Fibre Channel FC-2 frames, beginning with a Frame_Header.
    960  * Requested by Kahou Lei <kahou82 (at) gmail.com>.
    961  */
    962 #define DLT_FC_2		224
    963 
    964 /*
    965  * Fibre Channel FC-2 frames, beginning with an encoding of the
    966  * SOF, and ending with an encoding of the EOF.
    967  *
    968  * The encodings represent the frame delimiters as 4-byte sequences
    969  * representing the corresponding ordered sets, with K28.5
    970  * represented as 0xBC, and the D symbols as the corresponding
    971  * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2,
    972  * is represented as 0xBC 0xB5 0x55 0x55.
    973  *
    974  * Requested by Kahou Lei <kahou82 (at) gmail.com>.
    975  */
    976 #define DLT_FC_2_WITH_FRAME_DELIMS	225
    977 
    978 /*
    979  * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed (at) Sun.COM>.
    980  *
    981  * The pseudo-header starts with a one-byte version number; for version 2,
    982  * the pseudo-header is:
    983  *
    984  * struct dl_ipnetinfo {
    985  *     u_int8_t   dli_version;
    986  *     u_int8_t   dli_family;
    987  *     u_int16_t  dli_htype;
    988  *     u_int32_t  dli_pktlen;
    989  *     u_int32_t  dli_ifindex;
    990  *     u_int32_t  dli_grifindex;
    991  *     u_int32_t  dli_zsrc;
    992  *     u_int32_t  dli_zdst;
    993  * };
    994  *
    995  * dli_version is 2 for the current version of the pseudo-header.
    996  *
    997  * dli_family is a Solaris address family value, so it's 2 for IPv4
    998  * and 26 for IPv6.
    999  *
   1000  * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing
   1001  * packets, and 2 for packets arriving from another zone on the same
   1002  * machine.
   1003  *
   1004  * dli_pktlen is the length of the packet data following the pseudo-header
   1005  * (so the captured length minus dli_pktlen is the length of the
   1006  * pseudo-header, assuming the entire pseudo-header was captured).
   1007  *
   1008  * dli_ifindex is the interface index of the interface on which the
   1009  * packet arrived.
   1010  *
   1011  * dli_grifindex is the group interface index number (for IPMP interfaces).
   1012  *
   1013  * dli_zsrc is the zone identifier for the source of the packet.
   1014  *
   1015  * dli_zdst is the zone identifier for the destination of the packet.
   1016  *
   1017  * A zone number of 0 is the global zone; a zone number of 0xffffffff
   1018  * means that the packet arrived from another host on the network, not
   1019  * from another zone on the same machine.
   1020  *
   1021  * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates
   1022  * which of those it is.
   1023  */
   1024 #define DLT_IPNET		226
   1025 
   1026 /*
   1027  * CAN (Controller Area Network) frames, with a pseudo-header as supplied
   1028  * by Linux SocketCAN.  See Documentation/networking/can.txt in the Linux
   1029  * source.
   1030  *
   1031  * Requested by Felix Obenhuber <felix (at) obenhuber.de>.
   1032  */
   1033 #define DLT_CAN_SOCKETCAN	227
   1034 
   1035 /*
   1036  * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies
   1037  * whether it's v4 or v6.  Requested by Darren Reed <Darren.Reed (at) Sun.COM>.
   1038  */
   1039 #define DLT_IPV4		228
   1040 #define DLT_IPV6		229
   1041 
   1042 /*
   1043  * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
   1044  * nothing), and with no FCS at the end of the frame; requested by
   1045  * Jon Smirl <jonsmirl (at) gmail.com>.
   1046  */
   1047 #define DLT_IEEE802_15_4_NOFCS	230
   1048 
   1049 /*
   1050  * Raw D-Bus:
   1051  *
   1052  *	http://www.freedesktop.org/wiki/Software/dbus
   1053  *
   1054  * messages:
   1055  *
   1056  *	http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages
   1057  *
   1058  * starting with the endianness flag, followed by the message type, etc.,
   1059  * but without the authentication handshake before the message sequence:
   1060  *
   1061  *	http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol
   1062  *
   1063  * Requested by Martin Vidner <martin (at) vidner.net>.
   1064  */
   1065 #define DLT_DBUS		231
   1066 
   1067 /*
   1068  * Juniper-private data link type, as per request from
   1069  * Hannes Gredler <hannes (at) juniper.net>.
   1070  */
   1071 #define DLT_JUNIPER_VS			232
   1072 #define DLT_JUNIPER_SRX_E2E		233
   1073 #define DLT_JUNIPER_FIBRECHANNEL	234
   1074 
   1075 /*
   1076  * DVB-CI (DVB Common Interface for communication between a PC Card
   1077  * module and a DVB receiver).  See
   1078  *
   1079  *	http://www.kaiser.cx/pcap-dvbci.html
   1080  *
   1081  * for the specification.
   1082  *
   1083  * Requested by Martin Kaiser <martin (at) kaiser.cx>.
   1084  */
   1085 #define DLT_DVB_CI		235
   1086 
   1087 /*
   1088  * Variant of 3GPP TS 27.010 multiplexing protocol (similar to, but
   1089  * *not* the same as, 27.010).  Requested by Hans-Christoph Schemmel
   1090  * <hans-christoph.schemmel (at) cinterion.com>.
   1091  */
   1092 #define DLT_MUX27010		236
   1093 
   1094 /*
   1095  * STANAG 5066 D_PDUs.  Requested by M. Baris Demiray
   1096  * <barisdemiray (at) gmail.com>.
   1097  */
   1098 #define DLT_STANAG_5066_D_PDU	237
   1099 
   1100 /*
   1101  * Juniper-private data link type, as per request from
   1102  * Hannes Gredler <hannes (at) juniper.net>.
   1103  */
   1104 #define DLT_JUNIPER_ATM_CEMIC	238
   1105 
   1106 /*
   1107  * NetFilter LOG messages
   1108  * (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets)
   1109  *
   1110  * Requested by Jakub Zawadzki <darkjames-ws (at) darkjames.pl>
   1111  */
   1112 #define DLT_NFLOG		239
   1113 
   1114 /*
   1115  * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
   1116  * for Ethernet packets with a 4-byte pseudo-header and always
   1117  * with the payload including the FCS, as supplied by their
   1118  * netANALYZER hardware and software.
   1119  *
   1120  * Requested by Holger P. Frommer <HPfrommer (at) hilscher.com>
   1121  */
   1122 #define DLT_NETANALYZER		240
   1123 
   1124 /*
   1125  * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
   1126  * for Ethernet packets with a 4-byte pseudo-header and FCS and
   1127  * with the Ethernet header preceded by 7 bytes of preamble and
   1128  * 1 byte of SFD, as supplied by their netANALYZER hardware and
   1129  * software.
   1130  *
   1131  * Requested by Holger P. Frommer <HPfrommer (at) hilscher.com>
   1132  */
   1133 #define DLT_NETANALYZER_TRANSPARENT	241
   1134 
   1135 /*
   1136  * IP-over-InfiniBand, as specified by RFC 4391.
   1137  *
   1138  * Requested by Petr Sumbera <petr.sumbera (at) oracle.com>.
   1139  */
   1140 #define DLT_IPOIB		242
   1141 
   1142 /*
   1143  * MPEG-2 transport stream (ISO 13818-1/ITU-T H.222.0).
   1144  *
   1145  * Requested by Guy Martin <gmsoft (at) tuxicoman.be>.
   1146  */
   1147 #define DLT_MPEG_2_TS		243
   1148 
   1149 /*
   1150  * ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as
   1151  * used by their ng40 protocol tester.
   1152  *
   1153  * Requested by Jens Grimmer <jens.grimmer (at) ng4t.com>.
   1154  */
   1155 #define DLT_NG40		244
   1156 
   1157 /*
   1158  * Pseudo-header giving adapter number and flags, followed by an NFC
   1159  * (Near-Field Communications) Logical Link Control Protocol (LLCP) PDU,
   1160  * as specified by NFC Forum Logical Link Control Protocol Technical
   1161  * Specification LLCP 1.1.
   1162  *
   1163  * Requested by Mike Wakerly <mikey (at) google.com>.
   1164  */
   1165 #define DLT_NFC_LLCP		245
   1166 
   1167 /*
   1168  * 245 is used as LINKTYPE_PFSYNC; do not use it for any other purpose.
   1169  *
   1170  * DLT_PFSYNC has different values on different platforms, and all of
   1171  * them collide with something used elsewhere.  On platforms that
   1172  * don't already define it, define it as 245.
   1173  */
   1174 #if !defined(__FreeBSD__) && !defined(__OpenBSD__) && !defined(__NetBSD__) && !defined(__DragonFly__) && !defined(__APPLE__)
   1175 #define DLT_PFSYNC		246
   1176 #endif
   1177 
   1178 /*
   1179  * Raw InfiniBand packets, starting with the Local Routing Header.
   1180  *
   1181  * Requested by Oren Kladnitsky <orenk (at) mellanox.com>.
   1182  */
   1183 #define DLT_INFINIBAND		247
   1184 
   1185 /*
   1186  * SCTP, with no lower-level protocols (i.e., no IPv4 or IPv6).
   1187  *
   1188  * Requested by Michael Tuexen <Michael.Tuexen (at) lurchi.franken.de>.
   1189  */
   1190 #define DLT_SCTP		248
   1191 
   1192 /*
   1193  * USB packets, beginning with a USBPcap header.
   1194  *
   1195  * Requested by Tomasz Mon <desowin (at) gmail.com>
   1196  */
   1197 #define DLT_USBPCAP		249
   1198 
   1199 /*
   1200  * Schweitzer Engineering Laboratories "RTAC" product serial-line
   1201  * packets.
   1202  *
   1203  * Requested by Chris Bontje <chris_bontje (at) selinc.com>.
   1204  */
   1205 #define DLT_RTAC_SERIAL		250
   1206 
   1207 /*
   1208  * Bluetooth Low Energy air interface link-layer packets.
   1209  *
   1210  * Requested by Mike Kershaw <dragorn (at) kismetwireless.net>.
   1211  */
   1212 #define DLT_BLUETOOTH_LE_LL	251
   1213 
   1214 /*
   1215  * DLT type for upper-protocol layer PDU saves from wireshark.
   1216  *
   1217  * the actual contents are determined by two TAGs stored with each
   1218  * packet:
   1219  *   EXP_PDU_TAG_LINKTYPE          the link type (LINKTYPE_ value) of the
   1220  *				   original packet.
   1221  *
   1222  *   EXP_PDU_TAG_PROTO_NAME        the name of the wireshark dissector
   1223  * 				   that can make sense of the data stored.
   1224  */
   1225 #define DLT_WIRESHARK_UPPER_PDU	252
   1226 
   1227 #define DLT_MATCHING_MAX	252	/* highest value in the "matching" range */
   1228 
   1229 /*
   1230  * DLT and savefile link type values are split into a class and
   1231  * a member of that class.  A class value of 0 indicates a regular
   1232  * DLT_/LINKTYPE_ value.
   1233  */
   1234 #define DLT_CLASS(x)		((x) & 0x03ff0000)
   1235 
   1236 /*
   1237  * NetBSD-specific generic "raw" link type.  The class value indicates
   1238  * that this is the generic raw type, and the lower 16 bits are the
   1239  * address family we're dealing with.  Those values are NetBSD-specific;
   1240  * do not assume that they correspond to AF_ values for your operating
   1241  * system.
   1242  */
   1243 #define	DLT_CLASS_NETBSD_RAWAF	0x02240000
   1244 #define	DLT_NETBSD_RAWAF(af)	(DLT_CLASS_NETBSD_RAWAF | (af))
   1245 #define	DLT_NETBSD_RAWAF_AF(x)	((x) & 0x0000ffff)
   1246 #define	DLT_IS_NETBSD_RAWAF(x)	(DLT_CLASS(x) == DLT_CLASS_NETBSD_RAWAF)
   1247 
   1248 
   1249 /*
   1250  * The instruction encodings.
   1251  */
   1252 /* instruction classes */
   1253 #define BPF_CLASS(code) ((code) & 0x07)
   1254 #define		BPF_LD		0x00
   1255 #define		BPF_LDX		0x01
   1256 #define		BPF_ST		0x02
   1257 #define		BPF_STX		0x03
   1258 #define		BPF_ALU		0x04
   1259 #define		BPF_JMP		0x05
   1260 #define		BPF_RET		0x06
   1261 #define		BPF_MISC	0x07
   1262 
   1263 /* ld/ldx fields */
   1264 #define BPF_SIZE(code)	((code) & 0x18)
   1265 #define		BPF_W		0x00
   1266 #define		BPF_H		0x08
   1267 #define		BPF_B		0x10
   1268 #define BPF_MODE(code)	((code) & 0xe0)
   1269 #define		BPF_IMM 	0x00
   1270 #define		BPF_ABS		0x20
   1271 #define		BPF_IND		0x40
   1272 #define		BPF_MEM		0x60
   1273 #define		BPF_LEN		0x80
   1274 #define		BPF_MSH		0xa0
   1275 
   1276 /* alu/jmp fields */
   1277 #define BPF_OP(code)	((code) & 0xf0)
   1278 #define		BPF_ADD		0x00
   1279 #define		BPF_SUB		0x10
   1280 #define		BPF_MUL		0x20
   1281 #define		BPF_DIV		0x30
   1282 #define		BPF_OR		0x40
   1283 #define		BPF_AND		0x50
   1284 #define		BPF_LSH		0x60
   1285 #define		BPF_RSH		0x70
   1286 #define		BPF_NEG		0x80
   1287 #define		BPF_JA		0x00
   1288 #define		BPF_JEQ		0x10
   1289 #define		BPF_JGT		0x20
   1290 #define		BPF_JGE		0x30
   1291 #define		BPF_JSET	0x40
   1292 #define BPF_SRC(code)	((code) & 0x08)
   1293 #define		BPF_K		0x00
   1294 #define		BPF_X		0x08
   1295 
   1296 /* ret - BPF_K and BPF_X also apply */
   1297 #define BPF_RVAL(code)	((code) & 0x18)
   1298 #define		BPF_A		0x10
   1299 
   1300 /* misc */
   1301 #define BPF_MISCOP(code) ((code) & 0xf8)
   1302 #define		BPF_TAX		0x00
   1303 #define		BPF_TXA		0x80
   1304 
   1305 /*
   1306  * The instruction data structure.
   1307  */
   1308 struct bpf_insn {
   1309 	u_short	code;
   1310 	u_char 	jt;
   1311 	u_char 	jf;
   1312 	bpf_u_int32 k;
   1313 };
   1314 
   1315 /*
   1316  * Macros for insn array initializers.
   1317  */
   1318 #define BPF_STMT(code, k) { (u_short)(code), 0, 0, k }
   1319 #define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k }
   1320 
   1321 #if __STDC__ || defined(__cplusplus)
   1322 extern int bpf_validate(const struct bpf_insn *, int);
   1323 extern u_int bpf_filter(const struct bpf_insn *, const u_char *, u_int, u_int);
   1324 #else
   1325 extern int bpf_validate();
   1326 extern u_int bpf_filter();
   1327 #endif
   1328 
   1329 /*
   1330  * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
   1331  */
   1332 #define BPF_MEMWORDS 16
   1333 
   1334 #ifdef __cplusplus
   1335 }
   1336 #endif
   1337 
   1338 #endif /* !defined(_NET_BPF_H_) && !defined(_BPF_H_) && !defined(_H_BPF) && !defined(lib_pcap_bpf_h) */
   1339