pcap datalink LINUX_SLL

Question

Hi,

I'm trying to write a simple packet sniffer using libpcap. The first thing i'm trying to do when i capture a packet is to recognise the datalink protocol used and find the size of the header for that protocol in order to find the ip packet. The problem is that sometimes libpcap returns as datalink layer protocol the LINUX_SLL which is described as "Linux cooked" does anyone know the format of the headers for that protocol? or at least the size of the header.

Thanks a lot Giorgos

Answer 1

I think this will solve your problem for good: http://wiki.wireshark.org/SLL

Better yet, use Wireshark to read the pcap and it will show you the field types and their size.