Re: [tcpdump-workers] Request for DLT for new BlueZ Monitor

2014-02-14 Thread Guy Harris
On Dec 27, 2013, at 3:13 AM, Michal Labedzki wrote: > I think the best name for this is DLT_BLUETOOTH_LINUX_MONITOR, because > this is Linux kernelspace, not BlueZ userland. OK, LINKTYPE_BLUETOOTH_LINUX_MONITOR and DLT_BLUETOOTH_LINUX_MONITOR have been assigned the value 254. _

Re: [tcpdump-workers] Request for DLT for new BlueZ Monitor

2014-02-13 Thread Michal Labedzki
Ping. -- Pozdrawiam / Best regards - Michał Łabędzki, Software Engineer Tieto Corporation Product Development Services http://www.tieto.com / http://www.tieto.pl --- ASCII: Michal Labedz

Re: [tcpdump-workers] Request for DLT for new BlueZ Monitor

2014-02-04 Thread Michal Labedzki
Hello, Can I help you with something? (aka ping). Can I do Pull Request(s)? Pozdrawiam / Best regards - Michał Łabędzki, Software Engineer Tieto Corporation Product Development Services

Re: [tcpdump-workers] Request for DLT for new BlueZ Monitor

2014-01-16 Thread Michal Labedzki
It seems that new bluetooth DLT will be similar to existing LLCP: http://www.tcpdump.org/linktypes/LINKTYPE_NFC_LLCP.html Adapter Number -> Adapter Id (2 ocetets, network order) Flags -> Opcode (2 octets, network order) Payload -> Payload Pozdrawiam / Best regards ---

Re: [tcpdump-workers] Request for DLT for new BlueZ Monitor

2014-01-14 Thread Michal Labedzki
>I'd like to suggest that "struct _pcap_bluetooth_monitor_ header" is too generic a name when this header only applies to the internal workings of an operating system's HCI and adapter-lifetime traffic. Ok, "struct _pcap_bluetooth_linux_monitor_header" is ok? But this is for second phase. There is

Re: [tcpdump-workers] Request for DLT for new BlueZ Monitor

2014-01-14 Thread Chris Kilgour
I'd like to suggest that "struct _pcap_bluetooth_monitor_header" is too generic a name when this header only applies to the internal workings of an operating system's HCI and adapter-lifetime traffic. There are other forms of bluetooth monitoring that are not OS-specific nor even cover HCI. Fo

Re: [tcpdump-workers] Request for DLT for new BlueZ Monitor

2014-01-10 Thread Michal Labedzki
On 10 January 2014 01:47, Guy Harris wrote: > > On Dec 29, 2013, at 11:21 PM, Michal Labedzki > wrote: > >> Implementation in libpcap is very similar to pcap-bt-linux.c, but: >> 1. There is only one interface, let call it bluetooth-monitor > > I.e., it's like the "any" device". "Any Bluetooth D

Re: [tcpdump-workers] Request for DLT for new BlueZ Monitor

2014-01-09 Thread Guy Harris
On Dec 29, 2013, at 11:21 PM, Michal Labedzki wrote: > Implementation in libpcap is very similar to pcap-bt-linux.c, but: > 1. There is only one interface, let call it bluetooth-monitor I.e., it's like the "any" device". > 2. Pseudo header is: >guint16 adapter_id; So that presumably ind

Re: [tcpdump-workers] Request for DLT for new BlueZ Monitor

2013-12-29 Thread Michal Labedzki
Hello, You can see code in Wireshark side (great example, very similar, but this is only support for capture file changes): https://bugs.wireshark.org/bugzilla/attachment.cgi?id=12394 Implementation in libpcap is very similar to pcap-bt-linux.c, but: 1. There is only one interface, let call it bl

Re: [tcpdump-workers] Request for DLT for new BlueZ Monitor

2013-12-29 Thread Guy Harris
On Dec 27, 2013, at 3:13 AM, Michal Labedzki wrote: > 1. Bluetooth Linux Monitor use psedoheader to provide Opcode and > Adater Id which are required to correctly dissect payload (like > Bluetooth H4 with pseudoheader) What is the detailed format of the pseudo-header, and what is the payload th

Re: [tcpdump-workers] Request for DLT for new BlueZ Monitor

2013-12-27 Thread Michal Labedzki
Hello again, I think the best name for this is DLT_BLUETOOTH_LINUX_MONITOR, because this is Linux kernelspace, not BlueZ userland. By the way: I have completed implementation for new interface called bluetooth-monitor, based on this DLT. Please let me know when I can send patch on github for incl