Linux "cooked" capture encapsulation in libpcap/tcpdump doesn't allow to show interface name. There is v2 specification, but it hasn't been implemented yet.
No Hackers yet
This project is part of:
Hack Week 17
Comments
-
over 6 years ago by pvorel | Reply
First draft has been sent to tcpdump ML:
[tcpdump-workers] [RFC LIBPCAP PATCH 0/1] LINKTYPELINUXSLL2 implementation
[tcpdump-workers] [RFC TCPDUMP PATCH 0/2] LINKTYPELINUXSLL2 implementation
-
over 6 years ago by pvorel | Reply
Post Hackweek state: although my LINKTYPELINUXSLL2 implementation was not accepted (maintainer wrote own, much better implementation), I've learned a lot about libpcap and tcpdump internals + how libpcap/tcpdump community works (accepted some doc LINKTYPELINUXSLL2 related patches).
I was an impulse for maintainers to finish this long waiting implementation of feature Display/filter on packet direction and interface name: original bug #125 on sourceforge.net was created in 2009, it's migration to github #127 leaded just to the LINKTYPELINUXSLL2: Linux "cooked" capture encapsulation v2 specification.
ATM the specification has been published and got allocated DLT and LINKTYPE numbers (both my patches) and got implemented on libpcap and tcpdump side.
The actual code displaying packet name (my patch) is waiting as PR for comments or accepting (https://github.com/the-tcpdump-group/tcpdump/pull/689).
Similar Projects
This project is one of its kind!