From 47b3d6c254ca31dc57af4a1a17526e1dc593702a Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Thu, 10 Apr 2014 11:42:36 +0200 Subject: dissector: display packet direction for tap'ing on netlink devices (nlmon) Linux kernel provides nlmon device (ARPHRD_NETLINK) driver that can tap on netlink traffic, e.g.: Setup: modprobe nlmon ip link add type nlmon ip link set nlmon0 up Capture: netsniff-ng -i nlmon0 ... (or -i any) Teardown: ip link set nlmon0 down ip link del dev nlmon0 rmmod nlmon Provide information about the packet direction (user space or kernel space), so that dissector will show that properly. Signed-off-by: Daniel Borkmann --- dissector.h | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) (limited to 'dissector.h') diff --git a/dissector.h b/dissector.h index e26c235..c86a51d 100644 --- a/dissector.h +++ b/dissector.h @@ -28,12 +28,14 @@ extern char *if_indextoname(unsigned ifindex, char *ifname); static const char * const packet_types[256] = { - [PACKET_HOST] = "<", /* Incoming */ - [PACKET_BROADCAST] = "B", /* Broadcast */ - [PACKET_MULTICAST] = "M", /* Multicast */ - [PACKET_OTHERHOST] = "P", /* Promisc */ - [PACKET_OUTGOING] = ">", /* Outgoing */ - "?", /* Unknown */ + [0 ... 255] = "?", /* Unknown */ + [PACKET_HOST] = "<", /* Incoming */ + [PACKET_BROADCAST] = "B", /* Broadcast */ + [PACKET_MULTICAST] = "M", /* Multicast */ + [PACKET_OTHERHOST] = "P", /* Promisc */ + [PACKET_OUTGOING] = ">", /* Outgoing */ + [PACKET_USER] = ">U", /* To Userspace */ + [PACKET_KERNEL] = ">K", /* To Kernelspace */ }; static inline const char *__show_ts_source(uint32_t status) -- cgit v1.2.3-54-g00ecf