1

On a Linux system that I am testing now, it has a couple of virtual L2 devices chained together to add/manipulate our own frame headers which are encaped between Eth header and IP header.

now this is what "tcpdump -xx -i virtual_if_1" shows for a captured outgoing packet

tcpdump: WARNING: xxxtype 1000 not supported by libpcap - falling back to cooked socket
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on virtual_if_1, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes

20:20:25.558423 IP 0.0.0.0.52368 > 5.5.2.2.telnet: S 3501169179:3501169179(0) win 35848 <mss 17924,sackOK,timestamp 17386889 0,nop,wscale 8>
    0x0000:  0004 03e8 0006 0000 0000 1b9a 0000 0800
    0x0010:  4510 003c d792 4000 4006 5c13 0000 0000
    0x0020:  0505 0202 cc90 0017 d0af 9a1b 0000 0000
    0x0030:  a002 8c08 0735 0000 0204 4604 0402 080a
    0x0040:  0109 4d89 0000 0000 0103 0308`

Starting from 0x0010 it's IP header from L3, but 0x0000-0x000f is bogus, it is not the header this virtual device is supposed to prepend to the L3 header. It looks like tcpdump automatically adds an imaginary Ethernet header to it? It is because of the warning showed above, the type is not supported by lipcap?

Where does tcpdump gets this data anyway. is it from sk_buff->data?

Thanks

Improve this question

1 Answer 1

Reset to default
0

I guess I found my answer, it is indeed added by libcap as a pseudo protocol

Linktype_SLL header format

wireshark description of SLL

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .