Merge pull request #67 from koumajos/add_raw_format

Add DLT_RAW format of PCAP

Author: cejkato2

input/parser.cpp

@@ -617,8 +617,14 @@ void parse_packet(parser_opt_t *opt, struct timeval ts, const uint8_t *data, uin
    #ifdef WITH_PCAP
       if (opt->datalink == DLT_EN10MB) {
          data_offset = parse_eth_hdr(data, caplen, pkt);
-      } else {
-         data_offset = parse_sll(data, caplen, pkt);
+      } else if (opt->datalink == DLT_LINUX_SLL) {
+            data_offset = parse_sll(data, caplen, pkt);
+      } else if (opt->datalink == DLT_RAW) {
+            if ((data[0] & 0xF0) == 0x40) {
+               pkt->ethertype = ETH_P_IP;
+            } else if ((data[0] & 0xF0) == 0x60) {
+               pkt->ethertype = ETH_P_IPV6;
+            }
       }
    #else
       data_offset = parse_eth_hdr(data, caplen, pkt);

input/parser.hpp

@@ -50,6 +50,14 @@
 #define DLT_EN10MB 1
 #endif
 
+#ifndef DLT_LINUX_SLL
+#define DLT_LINUX_SLL 113
+#endif
+
+#ifndef DLT_RAW
+#define DLT_RAW 12
+#endif
+
 #ifndef ETH_P_8021AD
 #define ETH_P_8021AD	0x88A8          /* 802.1ad Service VLAN*/
 #endif

input/pcap.cpp

@@ -185,9 +185,9 @@ void PcapReader::open_ifc(const std::string &ifc)
 
 void PcapReader::check_datalink(int datalink)
 {
-   if (m_datalink != DLT_EN10MB && m_datalink != DLT_LINUX_SLL) {
+   if (m_datalink != DLT_EN10MB && m_datalink != DLT_LINUX_SLL && m_datalink != DLT_RAW) {
       close();
-      throw PluginError("unsupported link type detected, supported types are DLT_EN10MB and DLT_LINUX_SLL");
+      throw PluginError("unsupported link type detected, supported types are DLT_EN10MB and DLT_LINUX_SLL and DLT_RAW");
    }
 }