From 8bfd25602f0b14a427264900926941b1e9834e11 Mon Sep 17 00:00:00 2001 From: bert hubert Date: Tue, 17 Feb 2015 13:42:27 +0100 Subject: [PATCH] add support for raw IP tcpdump format, which makes is compatible with DNS OARC dnscap and closes #2246 --- pdns/dnspcap.cc | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/pdns/dnspcap.cc b/pdns/dnspcap.cc index 00e380223..e81e9b596 100644 --- a/pdns/dnspcap.cc +++ b/pdns/dnspcap.cc @@ -20,7 +20,11 @@ PcapPacketReader::PcapPacketReader(const string& fname) : d_fname(fname) if( d_pfh.linktype==1) { d_skipMediaHeader=sizeof(struct ether_header); - } else if(d_pfh.linktype==113) { + } + else if(d_pfh.linktype==101) { + d_skipMediaHeader=0; + } + else if(d_pfh.linktype==113) { d_skipMediaHeader=16; } else throw runtime_error((format("Unsupported link type %d") % d_pfh.linktype).str()); @@ -77,6 +81,12 @@ try uint16_t contentCode=0; if(d_pfh.linktype==1) contentCode=ntohs(d_ether->ether_type); + else if(d_pfh.linktype==101) { + if(d_ip->ip_v==4) + contentCode = 0x0800; + else + contentCode = 0x0806; // untested + } else if(d_pfh.linktype==113) contentCode=ntohs(d_lcc->lcc_protocol); -- 2.40.0