Re: [tcpdump-workers] vlan tagged packets and libpcap breakage

2012-11-18 Thread Daniel Borkmann
On Sat, Nov 17, 2012 at 11:14 PM, Michael Richardson wrote: > > Thank you for this reply. > >> "Eric" == Eric W Biederman writes: > Eric> I don't see any need to add any kernel code to allow checking > Eric> if vlan tags are stripped. Vlan headers are stripped on all > Eric> kern

Re: [tcpdump-workers] vlan tagged packets and libpcap breakage

2012-12-13 Thread Daniel Borkmann
On 12/12/2012 10:53 PM, Ani Sinha wrote: unsigned int netdev_8021q_inskb = 1; ... { .ctl_name = NET_CORE_8021q_INSKB, .procname = "netdev_8021q_inskb", .data = &netdev_8021q_inskb, .maxlen = siz

Re: [tcpdump-workers] vlan tagged packets and libpcap breakage

2012-12-13 Thread Daniel Borkmann
On Thu, Dec 13, 2012 at 6:34 PM, Ani Sinha wrote: > On Thu, Dec 13, 2012 at 12:35 AM, Daniel Borkmann wrote: >> On 12/12/2012 10:53 PM, Ani Sinha wrote: >>>> >>>> unsigned int netdev_8021q_inskb = 1; >>>> >>>> ... >>>>

Re: [tcpdump-workers] vlan tagged packets and libpcap breakage

2012-12-17 Thread Daniel Borkmann
On Mon, Dec 17, 2012 at 11:35 AM, Guy Harris wrote: > On Dec 17, 2012, at 1:50 AM, "David Laight" wrote: > >> How are you going to tell whether a feature is present in a non-Linux >> kernel ? > > The Linux memory-mapped capture mechanism is not present in a non-Linux > kernel, so all the libpcap

Re: [tcpdump-workers] [PATCH net 1/2] net: dev_queue_xmit_nit: fix skb->vlan_tci field value

2013-01-11 Thread Daniel Borkmann
On 01/11/2013 03:37 AM, Paul Pearce wrote: My opinion as a kernel developer is that the network tap is here to have a copy of the exact frame given to the _device_. Agreed. Good: as someone who spends lots of time with tcpdump doing both network and protocol diagnostics, it's really important

Re: [tcpdump-workers] PROBLEM: Software injected vlan tagged packets are unable to be identified using recent BPF modifications

2013-02-16 Thread Daniel Borkmann
On 02/15/2013 08:20 AM, Eric W. Biederman wrote: Tue, Jan 08, 2013 at 01:05:39AM CET, pea...@cs.berkeley.edu wrote: Hello folks, PROBLEM: vlan tagged packets that are injected via software are not picked up by filters using recent (kernel commit f3335031b9452baebfe49b8b5e55d3fe0c4677d1) BPF vl

[tcpdump-workers] [PATCH libpcap] linktype: add netlink link/dlt type

2013-07-03 Thread Daniel Borkmann
nlmon0 rmmod nlmon Signed-off-by: Daniel Borkmann CC: Thomas Graf CC: Tobias Klauser --- pcap-common.c | 7 ++- pcap/bpf.h| 7 ++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/pcap-common.c b/pcap-common.c index 6175a5a..f26d22e 100644 --- a/pcap-common.c +++ b/pcap

Re: [tcpdump-workers] [PATCH libpcap] linktype: add netlink link/dlt type

2013-07-20 Thread Daniel Borkmann
On 07/19/2013 08:23 PM, Guy Harris wrote: On Jul 3, 2013, at 3:49 AM, Daniel Borkmann wrote: For pcap interoperability, introduce a common link type for netlink captures. What do the link-layer headers for this look like? That is struct nlmsghdr, found in include/uapi/linux/netlink.h

[tcpdump-workers] [PATCH libpcap v2] linktype: add netlink link/dlt type

2013-07-24 Thread Daniel Borkmann
nlmon For pcap interoperability, introduce a common link type for netlink captures and map to it for ARPHRD_NETLINK. Signed-off-by: Daniel Borkmann CC: Thomas Graf CC: Tobias Klauser --- v1->v2: - Do ARPHRD to DLT mapping - Rebase on latest Git tree pcap-common.c | 7 ++- p

Re: [tcpdump-workers] [PATCH libpcap v2] linktype: add netlink link/dlt type

2013-08-05 Thread Daniel Borkmann
On 08/06/2013 12:29 AM, Guy Harris wrote: On Jul 24, 2013, at 2:26 AM, Daniel Borkmann wrote: With upcoming Linux 3.11, we have the possibility to debug local netlink traffic [1] i.e. the workflow looks like this: Setup: modprobe nlmon ip link add type nlmon ip link set nlmon0 up