1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
With this patch (in libpcap), tcpdump can be used on the CIPE device
so that it shows the traffic going over that device in unencrypted
form. (tcpdump on the device which holds the UDP address will show the
encrypted packets, for obvious reasons.) Similarly, on a conventional
IPIP tunnel, it will show the contents of the packets.
These are two different patches, one for libpcap 0.3 and one for
libpcap 0.4 or 0.5. Look which one your version of tcpdump uses.
--- libpcap-0.3/pcap-linux.c.orig Wed Dec 11 08:15:00 1996
+++ libpcap-0.3/pcap-linux.c Thu Jul 31 10:39:42 1997
@@ -160,6 +160,10 @@
p->linktype = DLT_NULL;
p->md.pad = 2;
p->md.skip = 12;
+ } else if (strncmp("tunl", device, 4) == 0) {
+ p->linktype = DLT_RAW;
+ } else if (strncmp("cip", device, 3) == 0) {
+ p->linktype = DLT_RAW;
} else {
sprintf(ebuf, "linux: unknown physical layer type");
goto bad;
--- libpcap-0.4a6/pcap-linux.c.orig Fri Oct 3 07:39:53 1997
+++ libpcap-0.4a6/pcap-linux.c Mon May 18 11:15:35 1998
@@ -235,6 +235,11 @@
break;
#endif
+ case ARPHRD_TUNNEL:
+ /* XXX I dont know if this is correct but it works for CIPE */
+ p->linktype = DLT_RAW;
+ break;
+
#ifdef notdef
case ARPHRD_LOCALTLK:
case ARPHRD_NETROM:
|
