dissector: display packet direction for tap'ing on netlink devices (nlmon)

Linux kernel provides nlmon device (ARPHRD_NETLINK) driver that
can tap on netlink traffic, e.g.:

Setup:
  modprobe nlmon
  ip link add type nlmon
  ip link set nlmon0 up

Capture:
  netsniff-ng -i nlmon0 ... (or -i any)

Teardown:
  ip link set nlmon0 down
  ip link del dev nlmon0
  rmmod nlmon

Provide information about the packet direction (user space or kernel
space), so that dissector will show that properly.

Signed-off-by: Daniel Borkmann <dborkman@redhat.com>

1 files changed, 8 insertions, 0 deletions

diff --git a/built_in.h b/built_in.h
index 20d7317..d7d4b6b 100644
--- a/built_in.h
+++ b/built_in.h
@@ -398,4 +398,12 @@ static inline u64 cpu_to_le64(u64 val)
 # define ARPHRD_NETLINK			824
 #endif
 
+#ifndef PACKET_USER
+# define PACKET_USER			6
+#endif
+
+#ifndef PACKET_KERNEL
+# define PACKET_KERNEL			7
+#endif
+
 #endif /* BUILT_IN_H */