On Wed, Nov 29, 2000 at 11:47:08AM +0800, Gerard Paul Java wrote:
>
> Hi,
>
> I'm trying to capture IP packets over a Token Ring network through a
> (PF_PACKET, SOCK_RAW) socket, but for some
> reason the sll_protocol field in the sockaddr_ll structure doesn't
> contain ETH_P_IP for IP packets but rather contains 0x100 (of course, in
> network byte order).
>
> Is this a bug, or is it expected behavior?
0x100 is ETH_P_802_3. This happens because some token ring packets
with an 802.3 header pass twice through the tap -- once to go to the
SNAP handler and then again afterwards to the final protocol. For IP
and ARP it should not happen though, because these take shortcuts and
only go once. You're probably seeing some other packet.
On the one hand it smells like a bug, on the other hand it is probably
not worth fixing because it is similar to the loopback or the tunnel devices
showing you packets multiple times.
-Andi
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Fri Dec 15 2000 - 21:00:18 EST