1/*
2 * Copyright (c) 2000-2025 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*
29 * Copyright (c) 1990, 1991, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * This code is derived from the Stanford/CMU enet packet filter,
33 * (net/enet.c) distributed as part of 4.3BSD, and code contributed
34 * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
35 * Berkeley Laboratory.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 * 1. Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in the
44 * documentation and/or other materials provided with the distribution.
45 * 3. All advertising materials mentioning features or use of this software
46 * must display the following acknowledgement:
47 * This product includes software developed by the University of
48 * California, Berkeley and its contributors.
49 * 4. Neither the name of the University nor the names of its contributors
50 * may be used to endorse or promote products derived from this software
51 * without specific prior written permission.
52 *
53 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
57 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63 * SUCH DAMAGE.
64 *
65 * @(#)bpf.h 8.1 (Berkeley) 6/10/93
66 * @(#)bpf.h 1.34 (LBL) 6/16/96
67 *
68 * $FreeBSD: src/sys/net/bpf.h,v 1.21.2.3 2001/08/01 00:23:13 fenner Exp $
69 */
70/*
71 * NOTICE: This file was modified by SPARTA, Inc. in 2006 to introduce
72 * support for mandatory and extensible security protections. This notice
73 * is included in support of clause 2.2 (b) of the Apple Public License,
74 * Version 2.0.
75 */
76
77#ifndef _NET_BPF_H_
78#define _NET_BPF_H_
79
80#include <stdint.h>
81
82#include <net/if.h>
83#include <sys/param.h>
84#include <sys/appleapiopts.h>
85#include <sys/types.h>
86#include <sys/time.h>
87#include <sys/cdefs.h>
88
89
90/* BSD style release date */
91#define BPF_RELEASE 199606
92
93typedef int32_t bpf_int32;
94typedef u_int32_t bpf_u_int32;
95
96/*
97 * Alignment macros. BPF_WORDALIGN rounds up to the next
98 * even multiple of BPF_ALIGNMENT.
99 */
100#define BPF_ALIGNMENT sizeof(int32_t)
101#define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
102
103#define BPF_MAXINSNS 512
104#define BPF_MAXBUFSIZE 0x80000
105#define BPF_MINBUFSIZE 32
106
107/*
108 * Structure for BIOCSETF.
109 */
110struct bpf_program {
111 u_int bf_len;
112 struct bpf_insn *bf_insns;
113};
114
115/*
116 * Struct returned by BIOCGSTATS.
117 */
118struct bpf_stat {
119 u_int bs_recv; /* number of packets received */
120 u_int bs_drop; /* number of packets dropped */
121};
122
123/*
124 * Struct return by BIOCVERSION. This represents the version number of
125 * the filter language described by the instruction encodings below.
126 * bpf understands a program iff kernel_major == filter_major &&
127 * kernel_minor >= filter_minor, that is, if the value returned by the
128 * running kernel has the same major number and a minor number equal
129 * equal to or less than the filter being downloaded. Otherwise, the
130 * results are undefined, meaning an error may be returned or packets
131 * may be accepted haphazardly.
132 * It has nothing to do with the source code version.
133 */
134struct bpf_version {
135 u_short bv_major;
136 u_short bv_minor;
137};
138
139#if defined(__LP64__)
140#include <sys/_types/_timeval32.h>
141
142#define BPF_TIMEVAL timeval32
143#else
144#include <sys/_types/_timeval.h>
145
146#define BPF_TIMEVAL timeval
147#endif /* __LP64__ */
148/* Current version number of filter architecture. */
149#define BPF_MAJOR_VERSION 1
150#define BPF_MINOR_VERSION 1
151
152#define BIOCGBLEN _IOR('B',102, u_int)
153#define BIOCSBLEN _IOWR('B',102, u_int)
154#define BIOCSETF _IOW('B',103, struct bpf_program)
155#define BIOCFLUSH _IO('B',104)
156#define BIOCPROMISC _IO('B',105)
157#define BIOCGDLT _IOR('B',106, u_int)
158#define BIOCGETIF _IOR('B',107, struct ifreq)
159#define BIOCSETIF _IOW('B',108, struct ifreq)
160#define BIOCSRTIMEOUT _IOW('B',109, struct timeval)
161#define BIOCGRTIMEOUT _IOR('B',110, struct timeval)
162#define BIOCGSTATS _IOR('B',111, struct bpf_stat)
163#define BIOCIMMEDIATE _IOW('B',112, u_int)
164#define BIOCVERSION _IOR('B',113, struct bpf_version)
165#define BIOCGRSIG _IOR('B',114, u_int)
166#define BIOCSRSIG _IOW('B',115, u_int)
167#define BIOCGHDRCMPLT _IOR('B',116, u_int)
168#define BIOCSHDRCMPLT _IOW('B',117, u_int)
169#define BIOCGSEESENT _IOR('B',118, u_int)
170#define BIOCSSEESENT _IOW('B',119, u_int)
171#define BIOCSDLT _IOW('B',120, u_int)
172#define BIOCGDLTLIST _IOWR('B',121, struct bpf_dltlist)
173#define BIOCSETFNR _IOW('B', 126, struct bpf_program)
174
175/*
176 * Structure prepended to each packet.
177 */
178struct bpf_hdr {
179 struct BPF_TIMEVAL bh_tstamp; /* time stamp */
180 bpf_u_int32 bh_caplen; /* length of captured portion */
181 bpf_u_int32 bh_datalen; /* original length of packet */
182 u_short bh_hdrlen; /* length of bpf header (this struct
183 * plus alignment padding) */
184};
185
186/*
187 * Data-link level type codes.
188 */
189#define DLT_NULL 0 /* no link-layer encapsulation */
190#define DLT_EN10MB 1 /* Ethernet (10Mb) */
191#define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */
192#define DLT_AX25 3 /* Amateur Radio AX.25 */
193#define DLT_PRONET 4 /* Proteon ProNET Token Ring */
194#define DLT_CHAOS 5 /* Chaos */
195#define DLT_IEEE802 6 /* IEEE 802 Networks */
196#define DLT_ARCNET 7 /* ARCNET */
197#define DLT_SLIP 8 /* Serial Line IP */
198#define DLT_PPP 9 /* Point-to-point Protocol */
199#define DLT_FDDI 10 /* FDDI */
200#define DLT_ATM_RFC1483 11 /* LLC/SNAP encapsulated atm */
201#define DLT_RAW 12 /* raw IP */
202
203/*
204 * These are values from BSD/OS's "bpf.h".
205 * These are not the same as the values from the traditional libpcap
206 * "bpf.h"; however, these values shouldn't be generated by any
207 * OS other than BSD/OS, so the correct values to use here are the
208 * BSD/OS values.
209 *
210 * Platforms that have already assigned these values to other
211 * DLT_ codes, however, should give these codes the values
212 * from that platform, so that programs that use these codes will
213 * continue to compile - even though they won't correctly read
214 * files of these types.
215 */
216#define DLT_SLIP_BSDOS 15 /* BSD/OS Serial Line IP */
217#define DLT_PPP_BSDOS 16 /* BSD/OS Point-to-point Protocol */
218
219/*
220 * 17 was used for DLT_PFLOG in OpenBSD; it no longer is.
221 *
222 * It was DLT_LANE8023 in SuSE 6.3, so we defined LINKTYPE_PFLOG
223 * as 117 so that pflog captures would use a link-layer header type
224 * value that didn't collide with any other values. On all
225 * platforms other than OpenBSD, we defined DLT_PFLOG as 117,
226 * and we mapped between LINKTYPE_PFLOG and DLT_PFLOG.
227 *
228 * OpenBSD eventually switched to using 117 for DLT_PFLOG as well.
229 *
230 * Don't use 17 for anything else.
231 */
232
233/*
234 * 18 is used for DLT_PFSYNC in OpenBSD, NetBSD, DragonFly BSD and
235 * Mac OS X; don't use it for anything else. (FreeBSD uses 121,
236 * which collides with DLT_HHDLC, even though it doesn't use 18
237 * for anything and doesn't appear to have ever used it for anything.)
238 *
239 * We define it as 18 on those platforms; it is, unfortunately, used
240 * for DLT_CIP in Suse 6.3, so we don't define it as DLT_PFSYNC
241 * in general. As the packet format for it, like that for
242 * DLT_PFLOG, is not only OS-dependent but OS-version-dependent,
243 * we don't support printing it in tcpdump except on OSes that
244 * have the relevant header files, so it's not that useful on
245 * other platforms.
246 */
247#define DLT_PFSYNC 18 /* Packet filter state syncing */
248
249#define DLT_ATM_CLIP 19 /* Linux Classical-IP over ATM */
250
251/*
252 * These values are defined by NetBSD; other platforms should refrain from
253 * using them for other purposes, so that NetBSD savefiles with link
254 * types of 50 or 51 can be read as this type on all platforms.
255 */
256#define DLT_PPP_SERIAL 50 /* PPP over serial with HDLC encapsulation */
257#define DLT_PPP_ETHER 51 /* PPP over Ethernet */
258
259/*
260 * The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses
261 * a link-layer type of 99 for the tcpdump it supplies. The link-layer
262 * header has 6 bytes of unknown data, something that appears to be an
263 * Ethernet type, and 36 bytes that appear to be 0 in at least one capture
264 * I've seen.
265 */
266#define DLT_SYMANTEC_FIREWALL 99
267
268/*
269 * Values between 100 and 103 are used in capture file headers as
270 * link-layer header type LINKTYPE_ values corresponding to DLT_ types
271 * that differ between platforms; don't use those values for new DLT_
272 * new types.
273 */
274
275/*
276 * Values starting with 104 are used for newly-assigned link-layer
277 * header type values; for those link-layer header types, the DLT_
278 * value returned by pcap_datalink() and passed to pcap_open_dead(),
279 * and the LINKTYPE_ value that appears in capture files, are the
280 * same.
281 *
282 * DLT_MATCHING_MIN is the lowest such value; DLT_MATCHING_MAX is
283 * the highest such value.
284 */
285#define DLT_MATCHING_MIN 104
286
287/*
288 * This value was defined by libpcap 0.5; platforms that have defined
289 * it with a different value should define it here with that value -
290 * a link type of 104 in a save file will be mapped to DLT_C_HDLC,
291 * whatever value that happens to be, so programs will correctly
292 * handle files with that link type regardless of the value of
293 * DLT_C_HDLC.
294 *
295 * The name DLT_C_HDLC was used by BSD/OS; we use that name for source
296 * compatibility with programs written for BSD/OS.
297 *
298 * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
299 * for source compatibility with programs written for libpcap 0.5.
300 */
301#define DLT_C_HDLC 104 /* Cisco HDLC */
302#define DLT_CHDLC DLT_C_HDLC
303
304#define DLT_IEEE802_11 105 /* IEEE 802.11 wireless */
305
306/*
307 * Values between 106 and 107 are used in capture file headers as
308 * link-layer types corresponding to DLT_ types that might differ
309 * between platforms; don't use those values for new DLT_ new types.
310 */
311
312/*
313 * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides
314 * with other values.
315 * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header
316 * (DLCI, etc.).
317 */
318#define DLT_FRELAY 107
319
320/*
321 * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
322 * that the AF_ type in the link-layer header is in network byte order.
323 *
324 * OpenBSD defines it as 12, but that collides with DLT_RAW, so we
325 * define it as 108 here. If OpenBSD picks up this file, it should
326 * define DLT_LOOP as 12 in its version, as per the comment above -
327 * and should not use 108 for any purpose.
328 */
329#define DLT_LOOP 108
330
331/*
332 * Values between 109 and 112 are used in capture file headers as
333 * link-layer types corresponding to DLT_ types that might differ
334 * between platforms; don't use those values for new DLT_ new types.
335 */
336
337/*
338 * Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's
339 * DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other
340 * than OpenBSD.
341 */
342#define DLT_ENC 109
343
344/*
345 * This is for Linux cooked sockets.
346 */
347#define DLT_LINUX_SLL 113
348
349/*
350 * Apple LocalTalk hardware.
351 */
352#define DLT_LTALK 114
353
354/*
355 * Acorn Econet.
356 */
357#define DLT_ECONET 115
358
359/*
360 * Reserved for use with OpenBSD ipfilter.
361 */
362#define DLT_IPFILTER 116
363
364/*
365 * For use in capture-file headers as a link-layer type corresponding
366 * to OpenBSD PF (Packet Filter) log.
367 */
368#define DLT_PFLOG 117
369
370/*
371 * Registered for Cisco-internal use.
372 */
373#define DLT_CISCO_IOS 118
374
375/*
376 * Reserved for 802.11 cards using the Prism II chips, with a link-layer
377 * header including Prism monitor mode information plus an 802.11
378 * header.
379 */
380#define DLT_PRISM_HEADER 119
381
382/*
383 * Reserved for Aironet 802.11 cards, with an Aironet link-layer header
384 * (see Doug Ambrisko's FreeBSD patches).
385 */
386#define DLT_AIRONET_HEADER 120
387
388/*
389 * Reserved for Siemens HiPath HDLC. XXX
390 */
391#define DLT_HHDLC 121
392
393/*
394 * Reserved for RFC 2625 IP-over-Fibre Channel.
395 */
396#define DLT_IP_OVER_FC 122
397
398/*
399 * Reserved for Full Frontal ATM on Solaris.
400 */
401#define DLT_SUNATM 123
402
403/*
404 * Reserved as per request from Kent Dahlgren <kent@praesum.com>
405 * for private use.
406 */
407#define DLT_RIO 124 /* RapidIO */
408#define DLT_PCI_EXP 125 /* PCI Express */
409#define DLT_AURORA 126 /* Xilinx Aurora link layer */
410
411/*
412 * BSD header for 802.11 plus a number of bits of link-layer information
413 * including radio information.
414 */
415#ifndef DLT_IEEE802_11_RADIO
416#define DLT_IEEE802_11_RADIO 127
417#endif
418
419/*
420 * Reserved for TZSP encapsulation.
421 */
422#define DLT_TZSP 128 /* Tazmen Sniffer Protocol */
423
424/*
425 * Reserved for Linux ARCNET.
426 */
427#define DLT_ARCNET_LINUX 129
428
429/*
430 * Juniper-private data link types.
431 */
432#define DLT_JUNIPER_MLPPP 130
433#define DLT_JUNIPER_MLFR 131
434#define DLT_JUNIPER_ES 132
435#define DLT_JUNIPER_GGSN 133
436#define DLT_JUNIPER_MFR 134
437#define DLT_JUNIPER_ATM2 135
438#define DLT_JUNIPER_SERVICES 136
439#define DLT_JUNIPER_ATM1 137
440
441/*
442 * Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund
443 * <dieter@apple.com>. The header that's presented is an Ethernet-like
444 * header:
445 *
446 * #define FIREWIRE_EUI64_LEN 8
447 * struct firewire_header {
448 * u_char firewire_dhost[FIREWIRE_EUI64_LEN];
449 * u_char firewire_shost[FIREWIRE_EUI64_LEN];
450 * u_short firewire_type;
451 * };
452 *
453 * with "firewire_type" being an Ethernet type value, rather than,
454 * for example, raw GASP frames being handed up.
455 */
456#define DLT_APPLE_IP_OVER_IEEE1394 138
457
458/*
459 * Various SS7 encapsulations, as per a request from Jeff Morriss
460 * <jeff.morriss[AT]ulticom.com> and subsequent discussions.
461 */
462#define DLT_MTP2_WITH_PHDR 139 /* pseudo-header with various info, followed by MTP2 */
463#define DLT_MTP2 140 /* MTP2, without pseudo-header */
464#define DLT_MTP3 141 /* MTP3, without pseudo-header or MTP2 */
465#define DLT_SCCP 142 /* SCCP, without pseudo-header or MTP2 or MTP3 */
466
467/*
468 * Reserved for DOCSIS.
469 */
470#define DLT_DOCSIS 143
471
472/*
473 * Reserved for Linux IrDA.
474 */
475#define DLT_LINUX_IRDA 144
476
477/*
478 * Reserved for IBM SP switch and IBM Next Federation switch.
479 */
480#define DLT_IBM_SP 145
481#define DLT_IBM_SN 146
482
483/*
484 * Reserved for private use. If you have some link-layer header type
485 * that you want to use within your organization, with the capture files
486 * using that link-layer header type not ever be sent outside your
487 * organization, you can use these values.
488 *
489 * No libpcap release will use these for any purpose, nor will any
490 * tcpdump release use them, either.
491 *
492 * Do *NOT* use these in capture files that you expect anybody not using
493 * your private versions of capture-file-reading tools to read; in
494 * particular, do *NOT* use them in products, otherwise you may find that
495 * people won't be able to use tcpdump, or snort, or Ethereal, or... to
496 * read capture files from your firewall/intrusion detection/traffic
497 * monitoring/etc. appliance, or whatever product uses that DLT_ value,
498 * and you may also find that the developers of those applications will
499 * not accept patches to let them read those files.
500 *
501 * Also, do not use them if somebody might send you a capture using them
502 * for *their* private type and tools using them for *your* private type
503 * would have to read them.
504 *
505 * Instead, ask "tcpdump-workers@tcpdump.org" for a new DLT_ value,
506 * as per the comment above, and use the type you're given.
507 */
508#define DLT_USER0 147
509#define DLT_USER1 148
510#define DLT_USER2 149
511#define DLT_USER3 150
512#define DLT_USER4 151
513#define DLT_USER5 152
514#define DLT_USER6 153
515#define DLT_USER7 154
516#define DLT_USER8 155
517#define DLT_USER9 156
518#define DLT_USER10 157
519#define DLT_USER11 158
520#define DLT_USER12 159
521#define DLT_USER13 160
522#define DLT_USER14 161
523#define DLT_USER15 162
524
525/*
526 * For future use with 802.11 captures - defined by AbsoluteValue
527 * Systems to store a number of bits of link-layer information
528 * including radio information:
529 *
530 * http://www.shaftnet.org/~pizza/software/capturefrm.txt
531 *
532 * but it might be used by some non-AVS drivers now or in the
533 * future.
534 */
535#define DLT_IEEE802_11_RADIO_AVS 163 /* 802.11 plus AVS radio header */
536
537/*
538 * Juniper-private data link type, as per request from
539 * Hannes Gredler <hannes@juniper.net>. The DLT_s are used
540 * for passing on chassis-internal metainformation such as
541 * QOS profiles, etc..
542 */
543#define DLT_JUNIPER_MONITOR 164
544
545/*
546 * Reserved for BACnet MS/TP.
547 */
548#define DLT_BACNET_MS_TP 165
549
550/*
551 * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>.
552 *
553 * This is used in some OSes to allow a kernel socket filter to distinguish
554 * between incoming and outgoing packets, on a socket intended to
555 * supply pppd with outgoing packets so it can do dial-on-demand and
556 * hangup-on-lack-of-demand; incoming packets are filtered out so they
557 * don't cause pppd to hold the connection up (you don't want random
558 * input packets such as port scans, packets from old lost connections,
559 * etc. to force the connection to stay up).
560 *
561 * The first byte of the PPP header (0xff03) is modified to accomodate
562 * the direction - 0x00 = IN, 0x01 = OUT.
563 */
564#define DLT_PPP_PPPD 166
565
566/*
567 * Names for backwards compatibility with older versions of some PPP
568 * software; new software should use DLT_PPP_PPPD.
569 */
570#define DLT_PPP_WITH_DIRECTION DLT_PPP_PPPD
571#define DLT_LINUX_PPP_WITHDIRECTION DLT_PPP_PPPD
572
573/*
574 * Juniper-private data link type, as per request from
575 * Hannes Gredler <hannes@juniper.net>. The DLT_s are used
576 * for passing on chassis-internal metainformation such as
577 * QOS profiles, cookies, etc..
578 */
579#define DLT_JUNIPER_PPPOE 167
580#define DLT_JUNIPER_PPPOE_ATM 168
581
582#define DLT_GPRS_LLC 169 /* GPRS LLC */
583#define DLT_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */
584#define DLT_GPF_F 171 /* GPF-F (ITU-T G.7041/Y.1303) */
585
586/*
587 * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line
588 * monitoring equipment.
589 */
590#define DLT_GCOM_T1E1 172
591#define DLT_GCOM_SERIAL 173
592
593/*
594 * Juniper-private data link type, as per request from
595 * Hannes Gredler <hannes@juniper.net>. The DLT_ is used
596 * for internal communication to Physical Interface Cards (PIC)
597 */
598#define DLT_JUNIPER_PIC_PEER 174
599
600/*
601 * Link types requested by Gregor Maier <gregor@endace.com> of Endace
602 * Measurement Systems. They add an ERF header (see
603 * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of
604 * the link-layer header.
605 */
606#define DLT_ERF_ETH 175 /* Ethernet */
607#define DLT_ERF_POS 176 /* Packet-over-SONET */
608
609/*
610 * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD
611 * for vISDN (http://www.orlandi.com/visdn/). Its link-layer header
612 * includes additional information before the LAPD header, so it's
613 * not necessarily a generic LAPD header.
614 */
615#define DLT_LINUX_LAPD 177
616
617/*
618 * Juniper-private data link type, as per request from
619 * Hannes Gredler <hannes@juniper.net>.
620 * The DLT_ are used for prepending meta-information
621 * like interface index, interface name
622 * before standard Ethernet, PPP, Frelay & C-HDLC Frames
623 */
624#define DLT_JUNIPER_ETHER 178
625#define DLT_JUNIPER_PPP 179
626#define DLT_JUNIPER_FRELAY 180
627#define DLT_JUNIPER_CHDLC 181
628
629/*
630 * Multi Link Frame Relay (FRF.16)
631 */
632#define DLT_MFR 182
633
634/*
635 * Juniper-private data link type, as per request from
636 * Hannes Gredler <hannes@juniper.net>.
637 * The DLT_ is used for internal communication with a
638 * voice Adapter Card (PIC)
639 */
640#define DLT_JUNIPER_VP 183
641
642/*
643 * Arinc 429 frames.
644 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
645 * Every frame contains a 32bit A429 label.
646 * More documentation on Arinc 429 can be found at
647 * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
648 */
649#define DLT_A429 184
650
651/*
652 * Arinc 653 Interpartition Communication messages.
653 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
654 * Please refer to the A653-1 standard for more information.
655 */
656#define DLT_A653_ICM 185
657
658/*
659 * USB packets, beginning with a USB setup header; requested by
660 * Paolo Abeni <paolo.abeni@email.it>.
661 */
662#define DLT_USB 186
663
664/*
665 * Bluetooth HCI UART transport layer (part H:4); requested by
666 * Paolo Abeni.
667 */
668#define DLT_BLUETOOTH_HCI_H4 187
669
670/*
671 * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
672 * <cruz_petagay@bah.com>.
673 */
674#define DLT_IEEE802_16_MAC_CPS 188
675
676/*
677 * USB packets, beginning with a Linux USB header; requested by
678 * Paolo Abeni <paolo.abeni@email.it>.
679 */
680#define DLT_USB_LINUX 189
681
682/*
683 * Controller Area Network (CAN) v. 2.0B packets.
684 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
685 * Used to dump CAN packets coming from a CAN Vector board.
686 * More documentation on the CAN v2.0B frames can be found at
687 * http://www.can-cia.org/downloads/?269
688 */
689#define DLT_CAN20B 190
690
691/*
692 * IEEE 802.15.4, with address fields padded, as is done by Linux
693 * drivers; requested by Juergen Schimmer.
694 */
695#define DLT_IEEE802_15_4_LINUX 191
696
697/*
698 * Per Packet Information encapsulated packets.
699 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
700 */
701#define DLT_PPI 192
702
703/*
704 * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
705 * requested by Charles Clancy.
706 */
707#define DLT_IEEE802_16_MAC_CPS_RADIO 193
708
709/*
710 * Juniper-private data link type, as per request from
711 * Hannes Gredler <hannes@juniper.net>.
712 * The DLT_ is used for internal communication with a
713 * integrated service module (ISM).
714 */
715#define DLT_JUNIPER_ISM 194
716
717/*
718 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
719 * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.
720 */
721#define DLT_IEEE802_15_4 195
722
723/*
724 * Various link-layer types, with a pseudo-header, for SITA
725 * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).
726 */
727#define DLT_SITA 196
728
729/*
730 * Various link-layer types, with a pseudo-header, for Endace DAG cards;
731 * encapsulates Endace ERF records. Requested by Stephen Donnelly
732 * <stephen@endace.com>.
733 */
734#define DLT_ERF 197
735
736/*
737 * Special header prepended to Ethernet packets when capturing from a
738 * u10 Networks board. Requested by Phil Mulholland
739 * <phil@u10networks.com>.
740 */
741#define DLT_RAIF1 198
742
743/*
744 * IPMB packet for IPMI, beginning with the I2C slave address, followed
745 * by the netFn and LUN, etc.. Requested by Chanthy Toeung
746 * <chanthy.toeung@ca.kontron.com>.
747 */
748#define DLT_IPMB 199
749
750/*
751 * Juniper-private data link type, as per request from
752 * Hannes Gredler <hannes@juniper.net>.
753 * The DLT_ is used for capturing data on a secure tunnel interface.
754 */
755#define DLT_JUNIPER_ST 200
756
757/*
758 * Bluetooth HCI UART transport layer (part H:4), with pseudo-header
759 * that includes direction information; requested by Paolo Abeni.
760 */
761#define DLT_BLUETOOTH_HCI_H4_WITH_PHDR 201
762
763/*
764 * AX.25 packet with a 1-byte KISS header; see
765 *
766 * http://www.ax25.net/kiss.htm
767 *
768 * as per Richard Stearn <richard@rns-stearn.demon.co.uk>.
769 */
770#define DLT_AX25_KISS 202
771
772/*
773 * LAPD packets from an ISDN channel, starting with the address field,
774 * with no pseudo-header.
775 * Requested by Varuna De Silva <varunax@gmail.com>.
776 */
777#define DLT_LAPD 203
778
779/*
780 * Variants of various link-layer headers, with a one-byte direction
781 * pseudo-header prepended - zero means "received by this host",
782 * non-zero (any non-zero value) means "sent by this host" - as per
783 * Will Barker <w.barker@zen.co.uk>.
784 */
785#define DLT_PPP_WITH_DIR 204 /* PPP - don't confuse with DLT_PPP_WITH_DIRECTION */
786#define DLT_C_HDLC_WITH_DIR 205 /* Cisco HDLC */
787#define DLT_FRELAY_WITH_DIR 206 /* Frame Relay */
788#define DLT_LAPB_WITH_DIR 207 /* LAPB */
789
790/*
791 * 208 is reserved for an as-yet-unspecified proprietary link-layer
792 * type, as requested by Will Barker.
793 */
794
795/*
796 * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman
797 * <avn@pigeonpoint.com>.
798 */
799#define DLT_IPMB_LINUX 209
800
801/*
802 * FlexRay automotive bus - http://www.flexray.com/ - as requested
803 * by Hannes Kaelber <hannes.kaelber@x2e.de>.
804 */
805#define DLT_FLEXRAY 210
806
807/*
808 * Media Oriented Systems Transport (MOST) bus for multimedia
809 * transport - http://www.mostcooperation.com/ - as requested
810 * by Hannes Kaelber <hannes.kaelber@x2e.de>.
811 */
812#define DLT_MOST 211
813
814/*
815 * Local Interconnect Network (LIN) bus for vehicle networks -
816 * http://www.lin-subbus.org/ - as requested by Hannes Kaelber
817 * <hannes.kaelber@x2e.de>.
818 */
819#define DLT_LIN 212
820
821/*
822 * X2E-private data link type used for serial line capture,
823 * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
824 */
825#define DLT_X2E_SERIAL 213
826
827/*
828 * X2E-private data link type used for the Xoraya data logger
829 * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
830 */
831#define DLT_X2E_XORAYA 214
832
833/*
834 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
835 * nothing), but with the PHY-level data for non-ASK PHYs (4 octets
836 * of 0 as preamble, one octet of SFD, one octet of frame length+
837 * reserved bit, and then the MAC-layer data, starting with the
838 * frame control field).
839 *
840 * Requested by Max Filippov <jcmvbkbc@gmail.com>.
841 */
842#define DLT_IEEE802_15_4_NONASK_PHY 215
843
844/*
845 * David Gibson <david@gibson.dropbear.id.au> requested this for
846 * captures from the Linux kernel /dev/input/eventN devices. This
847 * is used to communicate keystrokes and mouse movements from the
848 * Linux kernel to display systems, such as Xorg.
849 */
850#define DLT_LINUX_EVDEV 216
851
852/*
853 * GSM Um and Abis interfaces, preceded by a "gsmtap" header.
854 *
855 * Requested by Harald Welte <laforge@gnumonks.org>.
856 */
857#define DLT_GSMTAP_UM 217
858#define DLT_GSMTAP_ABIS 218
859
860/*
861 * MPLS, with an MPLS label as the link-layer header.
862 * Requested by Michele Marchetto <michele@openbsd.org> on behalf
863 * of OpenBSD.
864 */
865#define DLT_MPLS 219
866
867/*
868 * USB packets, beginning with a Linux USB header, with the USB header
869 * padded to 64 bytes; required for memory-mapped access.
870 */
871#define DLT_USB_LINUX_MMAPPED 220
872
873/*
874 * DECT packets, with a pseudo-header; requested by
875 * Matthias Wenzel <tcpdump@mazzoo.de>.
876 */
877#define DLT_DECT 221
878
879/*
880 * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov>
881 * Date: Mon, 11 May 2009 11:18:30 -0500
882 *
883 * DLT_AOS. We need it for AOS Space Data Link Protocol.
884 * I have already written dissectors for but need an OK from
885 * legal before I can submit a patch.
886 *
887 */
888#define DLT_AOS 222
889
890/*
891 * Wireless HART (Highway Addressable Remote Transducer)
892 * From the HART Communication Foundation
893 * IES/PAS 62591
894 *
895 * Requested by Sam Roberts <vieuxtech@gmail.com>.
896 */
897#define DLT_WIHART 223
898
899/*
900 * Fibre Channel FC-2 frames, beginning with a Frame_Header.
901 * Requested by Kahou Lei <kahou82@gmail.com>.
902 */
903#define DLT_FC_2 224
904
905/*
906 * Fibre Channel FC-2 frames, beginning with an encoding of the
907 * SOF, and ending with an encoding of the EOF.
908 *
909 * The encodings represent the frame delimiters as 4-byte sequences
910 * representing the corresponding ordered sets, with K28.5
911 * represented as 0xBC, and the D symbols as the corresponding
912 * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2,
913 * is represented as 0xBC 0xB5 0x55 0x55.
914 *
915 * Requested by Kahou Lei <kahou82@gmail.com>.
916 */
917#define DLT_FC_2_WITH_FRAME_DELIMS 225
918
919/*
920 * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>.
921 *
922 * The pseudo-header starts with a one-byte version number; for version 2,
923 * the pseudo-header is:
924 *
925 * struct dl_ipnetinfo {
926 * u_int8_t dli_version;
927 * u_int8_t dli_family;
928 * u_int16_t dli_htype;
929 * u_int32_t dli_pktlen;
930 * u_int32_t dli_ifindex;
931 * u_int32_t dli_grifindex;
932 * u_int32_t dli_zsrc;
933 * u_int32_t dli_zdst;
934 * };
935 *
936 * dli_version is 2 for the current version of the pseudo-header.
937 *
938 * dli_family is a Solaris address family value, so it's 2 for IPv4
939 * and 26 for IPv6.
940 *
941 * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing
942 * packets, and 2 for packets arriving from another zone on the same
943 * machine.
944 *
945 * dli_pktlen is the length of the packet data following the pseudo-header
946 * (so the captured length minus dli_pktlen is the length of the
947 * pseudo-header, assuming the entire pseudo-header was captured).
948 *
949 * dli_ifindex is the interface index of the interface on which the
950 * packet arrived.
951 *
952 * dli_grifindex is the group interface index number (for IPMP interfaces).
953 *
954 * dli_zsrc is the zone identifier for the source of the packet.
955 *
956 * dli_zdst is the zone identifier for the destination of the packet.
957 *
958 * A zone number of 0 is the global zone; a zone number of 0xffffffff
959 * means that the packet arrived from another host on the network, not
960 * from another zone on the same machine.
961 *
962 * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates
963 * which of those it is.
964 */
965#define DLT_IPNET 226
966
967/*
968 * CAN (Controller Area Network) frames, with a pseudo-header as supplied
969 * by Linux SocketCAN. See Documentation/networking/can.txt in the Linux
970 * source.
971 *
972 * Requested by Felix Obenhuber <felix@obenhuber.de>.
973 */
974#define DLT_CAN_SOCKETCAN 227
975
976/*
977 * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies
978 * whether it's v4 or v6. Requested by Darren Reed <Darren.Reed@Sun.COM>.
979 */
980#define DLT_IPV4 228
981#define DLT_IPV6 229
982
983/*
984 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
985 * nothing), and with no FCS at the end of the frame; requested by
986 * Jon Smirl <jonsmirl@gmail.com>.
987 */
988#define DLT_IEEE802_15_4_NOFCS 230
989
990/*
991 * Raw D-Bus:
992 *
993 * http://www.freedesktop.org/wiki/Software/dbus
994 *
995 * messages:
996 *
997 * http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages
998 *
999 * starting with the endianness flag, followed by the message type, etc.,
1000 * but without the authentication handshake before the message sequence:
1001 *
1002 * http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol
1003 *
1004 * Requested by Martin Vidner <martin@vidner.net>.
1005 */
1006#define DLT_DBUS 231
1007
1008/*
1009 * Juniper-private data link type, as per request from
1010 * Hannes Gredler <hannes@juniper.net>.
1011 */
1012#define DLT_JUNIPER_VS 232
1013#define DLT_JUNIPER_SRX_E2E 233
1014#define DLT_JUNIPER_FIBRECHANNEL 234
1015
1016/*
1017 * DVB-CI (DVB Common Interface for communication between a PC Card
1018 * module and a DVB receiver). See
1019 *
1020 * http://www.kaiser.cx/pcap-dvbci.html
1021 *
1022 * for the specification.
1023 *
1024 * Requested by Martin Kaiser <martin@kaiser.cx>.
1025 */
1026#define DLT_DVB_CI 235
1027
1028/*
1029 * Variant of 3GPP TS 27.010 multiplexing protocol (similar to, but
1030 * *not* the same as, 27.010). Requested by Hans-Christoph Schemmel
1031 * <hans-christoph.schemmel@cinterion.com>.
1032 */
1033#define DLT_MUX27010 236
1034
1035/*
1036 * STANAG 5066 D_PDUs. Requested by M. Baris Demiray
1037 * <barisdemiray@gmail.com>.
1038 */
1039#define DLT_STANAG_5066_D_PDU 237
1040
1041/*
1042 * Juniper-private data link type, as per request from
1043 * Hannes Gredler <hannes@juniper.net>.
1044 */
1045#define DLT_JUNIPER_ATM_CEMIC 238
1046
1047/*
1048 * NetFilter LOG messages
1049 * (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets)
1050 *
1051 * Requested by Jakub Zawadzki <darkjames-ws@darkjames.pl>
1052 */
1053#define DLT_NFLOG 239
1054
1055/*
1056 * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
1057 * for Ethernet packets with a 4-byte pseudo-header and always
1058 * with the payload including the FCS, as supplied by their
1059 * netANALYZER hardware and software.
1060 *
1061 * Requested by Holger P. Frommer <HPfrommer@hilscher.com>
1062 */
1063#define DLT_NETANALYZER 240
1064
1065/*
1066 * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
1067 * for Ethernet packets with a 4-byte pseudo-header and FCS and
1068 * with the Ethernet header preceded by 7 bytes of preamble and
1069 * 1 byte of SFD, as supplied by their netANALYZER hardware and
1070 * software.
1071 *
1072 * Requested by Holger P. Frommer <HPfrommer@hilscher.com>
1073 */
1074#define DLT_NETANALYZER_TRANSPARENT 241
1075
1076/*
1077 * IP-over-Infiniband, as specified by RFC 4391.
1078 *
1079 * Requested by Petr Sumbera <petr.sumbera@oracle.com>.
1080 */
1081#define DLT_IPOIB 242
1082
1083/*
1084 * MPEG-2 transport stream (ISO 13818-1/ITU-T H.222.0).
1085 *
1086 * Requested by Guy Martin <gmsoft@tuxicoman.be>.
1087 */
1088#define DLT_MPEG_2_TS 243
1089
1090/*
1091 * ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as
1092 * used by their ng40 protocol tester.
1093 *
1094 * Requested by Jens Grimmer <jens.grimmer@ng4t.com>.
1095 */
1096#define DLT_NG40 244
1097
1098/*
1099 * Pseudo-header giving adapter number and flags, followed by an NFC
1100 * (Near-Field Communications) Logical Link Control Protocol (LLCP) PDU,
1101 * as specified by NFC Forum Logical Link Control Protocol Technical
1102 * Specification LLCP 1.1.
1103 *
1104 * Requested by Mike Wakerly <mikey@google.com>.
1105 */
1106#define DLT_NFC_LLCP 245
1107
1108/*
1109 * USB packets, beginning with a Darwin (macOS, etc.) USB header.
1110 */
1111#define DLT_USB_DARWIN 266
1112
1113#define DLT_MATCHING_MAX 266 /* highest value in the "matching" range */
1114
1115/*
1116 * The instruction encodings.
1117 */
1118/* instruction classes */
1119#define BPF_CLASS(code) ((code) & 0x07)
1120#define BPF_LD 0x00
1121#define BPF_LDX 0x01
1122#define BPF_ST 0x02
1123#define BPF_STX 0x03
1124#define BPF_ALU 0x04
1125#define BPF_JMP 0x05
1126#define BPF_RET 0x06
1127#define BPF_MISC 0x07
1128
1129/* ld/ldx fields */
1130#define BPF_SIZE(code) ((code) & 0x18)
1131#define BPF_W 0x00
1132#define BPF_H 0x08
1133#define BPF_B 0x10
1134#define BPF_MODE(code) ((code) & 0xe0)
1135#define BPF_IMM 0x00
1136#define BPF_ABS 0x20
1137#define BPF_IND 0x40
1138#define BPF_MEM 0x60
1139#define BPF_LEN 0x80
1140#define BPF_MSH 0xa0
1141
1142/* alu/jmp fields */
1143#define BPF_OP(code) ((code) & 0xf0)
1144#define BPF_ADD 0x00
1145#define BPF_SUB 0x10
1146#define BPF_MUL 0x20
1147#define BPF_DIV 0x30
1148#define BPF_OR 0x40
1149#define BPF_AND 0x50
1150#define BPF_LSH 0x60
1151#define BPF_RSH 0x70
1152#define BPF_NEG 0x80
1153#define BPF_JA 0x00
1154#define BPF_JEQ 0x10
1155#define BPF_JGT 0x20
1156#define BPF_JGE 0x30
1157#define BPF_JSET 0x40
1158#define BPF_SRC(code) ((code) & 0x08)
1159#define BPF_K 0x00
1160#define BPF_X 0x08
1161
1162/* ret - BPF_K and BPF_X also apply */
1163#define BPF_RVAL(code) ((code) & 0x18)
1164#define BPF_A 0x10
1165
1166/* misc */
1167#define BPF_MISCOP(code) ((code) & 0xf8)
1168#define BPF_TAX 0x00
1169#define BPF_TXA 0x80
1170
1171/*
1172 * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
1173 */
1174#define BPF_MEMWORDS 16
1175
1176/*
1177 * The instruction data structure.
1178 */
1179struct bpf_insn {
1180 u_short code;
1181 u_char jt;
1182 u_char jf;
1183 bpf_u_int32 k;
1184};
1185
1186/*
1187 * Macros for insn array initializers.
1188 */
1189#define BPF_STMT(code, k) { (u_short)(code), 0, 0, k }
1190#define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k }
1191
1192#pragma pack(4)
1193
1194/*
1195 * Structure to retrieve available DLTs for the interface.
1196 */
1197struct bpf_dltlist {
1198 u_int32_t bfl_len; /* number of bfd_list array */
1199 union {
1200 u_int32_t *bflu_list; /* array of DLTs */
1201 u_int64_t bflu_pad;
1202 } bfl_u;
1203};
1204#define bfl_list bfl_u.bflu_list
1205
1206#pragma pack()
1207
1208
1209
1210
1211
1212#endif /* _NET_BPF_H_ */