Question

In the system I am testing right now, it has a couple of virtual L2 devices chained together to add our own L2.5 headers between Eth headers and IP headers. Now when I use

tcpdump -xx -i vir_device_1

, it actually shows the SLL header with IP header. How do I capture the full packet that is actually going out of the vir_device_1, i.e. after the ndo_start_xmit() device call?

Answer 1

How do I capture the full packet that is actually going out of the vir_device_1, i.e. after the ndo_start_xmit() device call?

Either by writing your own code to directly use a PF_PACKET/SOCK_RAW socket (you say “SLL header”, so this is presumably Linux), or by:

• making sure you’ve assigned a special ARPHRD_ value for your virtual interface;
• using one of the DLT_USERn values for your special set of headers, or asking [e-mail] for an official DLT_ value to be assigned for them;
• modifying libpcap to map that ARPHRD_ value to the DLT_ value you’re using;
• modifying tcpdump to handle that DLT_ value;
• if necessary, modifying other programs that would capture on that interface or read capture files as written by tcpdump on that interface to handle that value as well.

Note that the DLT_USERn values are specifically reserved for private use, and no official versions of libpcap, tcpdump, or Wireshark will ever assign them for their own use (i.e., if you use a DLT_USERn value, don’t bother contributing patches to assign that value to your type of headers, as they won’t be accepted; other people may already be using it for their own special headers, and that must continue to be supported), so you’ll have to maintain the modified versions of libpcap, tcpdump, etc. yourself if you use one of those values rather than getting an official value assigned.