On a Linux system that I am testing now, it has a couple of virtual L2 devices chained together to add/manipulate our own frame headers which are encaped between Eth header and IP header.
now this is what "tcpdump -xx -i virtual_if_1" shows for a captured outgoing packet
tcpdump: WARNING: xxxtype 1000 not supported by libpcap - falling back to cooked socket tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on virtual_if_1, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes 20:20:25.558423 IP 0.0.0.0.52368 > 220.127.116.11.telnet: S 3501169179:3501169179(0) win 35848 <mss 17924,sackOK,timestamp 17386889 0,nop,wscale 8> 0x0000: 0004 03e8 0006 0000 0000 1b9a 0000 0800 0x0010: 4510 003c d792 4000 4006 5c13 0000 0000 0x0020: 0505 0202 cc90 0017 d0af 9a1b 0000 0000 0x0030: a002 8c08 0735 0000 0204 4604 0402 080a 0x0040: 0109 4d89 0000 0000 0103 0308`
Starting from 0x0010 it's IP header from L3, but 0x0000-0x000f is bogus, it is not the header this virtual device is supposed to prepend to the L3 header. It looks like tcpdump automatically adds an imaginary Ethernet header to it? It is because of the warning showed above, the type is not supported by lipcap?
Where does tcpdump gets this data anyway. is it from sk_buff->data?