[lkml]   [2000]   [Dec]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: PF_PACKET and Token Ring
On Wed, Nov 29, 2000 at 11:47:08AM +0800, Gerard Paul Java wrote:
> Hi,
> I'm trying to capture IP packets over a Token Ring network through a
> (PF_PACKET, SOCK_RAW) socket, but for some
> reason the sll_protocol field in the sockaddr_ll structure doesn't
> contain ETH_P_IP for IP packets but rather contains 0x100 (of course, in
> network byte order).
> Is this a bug, or is it expected behavior?

0x100 is ETH_P_802_3. This happens because some token ring packets
with an 802.3 header pass twice through the tap -- once to go to the
SNAP handler and then again afterwards to the final protocol. For IP
and ARP it should not happen though, because these take shortcuts and
only go once. You're probably seeing some other packet.

On the one hand it smells like a bug, on the other hand it is probably
not worth fixing because it is similar to the loopback or the tunnel devices
showing you packets multiple times.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 12:52    [W:0.028 / U:1.588 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site