Linux "cooked" capture encapsulation in libpcap/tcpdump doesn't allow to show interface name. There is v2 specification, but it hasn't been implemented yet.

Looking for hackers with the skills:

libpcap tcpdump

This project is part of:

Hack Week 17

Activity

  • over 5 years ago: mkubecek liked this project.
  • over 5 years ago: pvorel added keyword "libpcap" to this project.
  • over 5 years ago: pvorel added keyword "tcpdump" to this project.
  • over 5 years ago: pvorel originated this project.

  • Comments

    • pvorel
    • pvorel
      over 5 years ago by pvorel | Reply

      Post Hackweek state: although my LINKTYPELINUXSLL2 implementation was not accepted (maintainer wrote own, much better implementation), I've learned a lot about libpcap and tcpdump internals + how libpcap/tcpdump community works (accepted some doc LINKTYPELINUXSLL2 related patches).

      I was an impulse for maintainers to finish this long waiting implementation of feature Display/filter on packet direction and interface name: original bug #125 on sourceforge.net was created in 2009, it's migration to github #127 leaded just to the LINKTYPELINUXSLL2: Linux "cooked" capture encapsulation v2 specification.

      ATM the specification has been published and got allocated DLT and LINKTYPE numbers (both my patches) and got implemented on libpcap and tcpdump side.

      The actual code displaying packet name (my patch) is waiting as PR for comments or accepting (https://github.com/the-tcpdump-group/tcpdump/pull/689).

    Similar Projects

    This project is one of its kind!