void capture_ethertype(guint16 etype, const guchar *pd, int offset, int len, packet_counts *ld) { switch (etype) { case ETHERTYPE_ARP: ld->arp++; break; case ETHERTYPE_IP: capture_ip(pd, offset, len, ld); break; case ETHERTYPE_IPv6: capture_ipv6(pd, offset, len, ld); break; case ETHERTYPE_IPX: capture_ipx(ld); break; case ETHERTYPE_VLAN: capture_vlan(pd, offset, len, ld); break; case ETHERTYPE_IEEE_802_1AD: case ETHERTYPE_IEEE_802_1AH: capture_ieee8021ah(pd, offset, len, ld); break; case ETHERTYPE_VINES_IP: case ETHERTYPE_VINES_ECHO: capture_vines(ld); break; default: ld->other++; break; } }
void capture_raw(const guchar *pd, int len, packet_counts *ld) { /* So far, the only time we get raw connection types are with Linux and * Irix PPP connections. We can't tell what type of data is coming down * the line, so our safest bet is IP. - GCC */ /* Currently, the Linux 2.1.xxx PPP driver passes back some of the header * sometimes. This check should be removed when 2.2 is out. */ if (BYTES_ARE_IN_FRAME(0,len,2) && pd[0] == 0xff && pd[1] == 0x03) { capture_ppp_hdlc(pd, 0, len, ld); } /* The Linux ISDN driver sends a fake MAC address before the PPP header * on its ippp interfaces... */ else if (BYTES_ARE_IN_FRAME(0,len,8) && pd[6] == 0xff && pd[7] == 0x03) { capture_ppp_hdlc(pd, 6, len, ld); } /* ...except when it just puts out one byte before the PPP header... */ else if (BYTES_ARE_IN_FRAME(0,len,3) && pd[1] == 0xff && pd[2] == 0x03) { capture_ppp_hdlc(pd, 1, len, ld); } /* ...and if the connection is currently down, it sends 10 bytes of zeroes * instead of a fake MAC address and PPP header. */ else if (BYTES_ARE_IN_FRAME(0,len,10) && memcmp(pd, zeroes, 10) == 0) { capture_ip(pd, 10, len, ld); } else { /* * OK, is this IPv4 or IPv6? */ if (BYTES_ARE_IN_FRAME(0,len,1)) { switch (pd[0] & 0xF0) { case 0x40: /* IPv4 */ capture_ip(pd, 0, len, ld); break; #if 0 case 0x60: /* IPv6 */ capture_ipv6(pd, 0, len, ld); break; #endif } } } }