2000-11-29 04:17:33

by Gerard Paul Java

[permalink] [raw]
Subject: PF_PACKET and Token Ring


Hi,

I'm trying to capture IP packets over a Token Ring network through a
(PF_PACKET, SOCK_RAW) socket, but for some
reason the sll_protocol field in the sockaddr_ll structure doesn't
contain ETH_P_IP for IP packets but rather contains 0x100 (of course, in
network byte order).

Is this a bug, or is it expected behavior?

----------------------------------------------------------------
Gerard Paul R. Java
System Administrator, Mosaic Communications Cebu
primary: [email protected]
secondary: [email protected]



2000-12-10 04:50:16

by Andi Kleen

[permalink] [raw]
Subject: Re: PF_PACKET and Token Ring

On Wed, Nov 29, 2000 at 11:47:08AM +0800, Gerard Paul Java wrote:
>
> Hi,
>
> I'm trying to capture IP packets over a Token Ring network through a
> (PF_PACKET, SOCK_RAW) socket, but for some
> reason the sll_protocol field in the sockaddr_ll structure doesn't
> contain ETH_P_IP for IP packets but rather contains 0x100 (of course, in
> network byte order).
>
> Is this a bug, or is it expected behavior?

0x100 is ETH_P_802_3. This happens because some token ring packets
with an 802.3 header pass twice through the tap -- once to go to the
SNAP handler and then again afterwards to the final protocol. For IP
and ARP it should not happen though, because these take shortcuts and
only go once. You're probably seeing some other packet.

On the one hand it smells like a bug, on the other hand it is probably
not worth fixing because it is similar to the loopback or the tunnel devices
showing you packets multiple times.


-Andi