Messages in this thread | | | Date | Sun, 10 Dec 2000 05:19:23 +0100 | From | Andi Kleen <> | Subject | Re: PF_PACKET and Token Ring |
| |
On Wed, Nov 29, 2000 at 11:47:08AM +0800, Gerard Paul Java wrote: > > Hi, > > I'm trying to capture IP packets over a Token Ring network through a > (PF_PACKET, SOCK_RAW) socket, but for some > reason the sll_protocol field in the sockaddr_ll structure doesn't > contain ETH_P_IP for IP packets but rather contains 0x100 (of course, in > network byte order). > > Is this a bug, or is it expected behavior?
0x100 is ETH_P_802_3. This happens because some token ring packets with an 802.3 header pass twice through the tap -- once to go to the SNAP handler and then again afterwards to the final protocol. For IP and ARP it should not happen though, because these take shortcuts and only go once. You're probably seeing some other packet.
On the one hand it smells like a bug, on the other hand it is probably not worth fixing because it is similar to the loopback or the tunnel devices showing you packets multiple times.
-Andi - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org Please read the FAQ at http://www.tux.org/lkml/
| |