From 9977ec6012452bfc5053dbc90aed53f55064c86b Mon Sep 17 00:00:00 2001 From: Vadim Kochan Date: Tue, 16 Jun 2015 04:10:19 +0300 Subject: netsniff-ng: Add dissector for Linux "cooked" packets Added dissector_sll.c which uses sockaddr_ll to lookup & print higher L3 layer protocol. This dissector is mapped by LINKTYPE_LINUX_SLL link type. Sample output of dissected Netlink & Ethernet packets. Truncated manually some longer lines by "...": > nlmon0 20 1434193547s.717131169ns #6 [ Linux "cooked" Pkt Type 4 (outgoing), If Type 824 (netlink), Addr Len 0, Src (), Proto 0x0 ] [ NLMSG Family 0 (routing), Len 20, Type 0x0003 (DONE)... > wlp3s0 52 1434194181s.436224709ns #9 [ Linux "cooked" Pkt Type 4 (outgoing), If Type 1 (ether), Addr Len 6, Src (XX:XX:XX:XX:XX:XX), Proto 0x800 ] [ IPv4 Addr (XXX.XXX.XXX.XXX => 212.42.76.253), Proto (6), TTL (64), TOS (0), ... ), CSum (0x1ef5) is ok ] [ Geo (local => Ukraine) ] [ TCP Port (45849 => 443 (https)), SN (0x1744209), AN (0x46ca9611), DataOff (8) ... [ Chr .....w.Rj).. ] [ Hex XX XX XX XX XX XX XX XX XX XX XX XX ] Signed-off-by: Vadim Kochan Signed-off-by: Daniel Borkmann --- proto_nlmsg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'proto_nlmsg.c') diff --git a/proto_nlmsg.c b/proto_nlmsg.c index 5018adf..44ef328 100644 --- a/proto_nlmsg.c +++ b/proto_nlmsg.c @@ -740,7 +740,7 @@ static void nlmsg(struct pkt_buff *pkt) struct nlmsghdr *hdr = (struct nlmsghdr *) pkt_pull(pkt, sizeof(*hdr)); while (hdr) { - nlmsg_print(ntohs(pkt->proto), hdr); + nlmsg_print(ntohs(pkt->sll->sll_protocol), hdr); if (!pkt_pull(pkt, NLMSG_PAYLOAD(hdr, 0))) break; @@ -755,7 +755,7 @@ static void nlmsg(struct pkt_buff *pkt) static void nlmsg_less(struct pkt_buff *pkt) { struct nlmsghdr *hdr = (struct nlmsghdr *) pkt_pull(pkt, sizeof(*hdr)); - uint16_t family = ntohs(pkt->proto); + uint16_t family = ntohs(pkt->sll->sll_protocol); char type[32]; if (hdr == NULL) -- cgit v1.2.3-54-g00ecf