netflow tools - Nov 2005 - "Unsupported datalink type 113"

Moving right along (after using gcc-3.3, not gcc-4)

If I try to run softflowd against my ppp0. I get a datalink error:

me at mymachine:~/softflowd-0.9.7$ sudo ./softflowd -d -D -i ppp0 
-nlocalhost:2205
Unsupported datalink type 113

My ppp0 is PPPoE.  In the header file, I see DLT_LINUX_SLL is 113, for 
"Linux cooked sockets".

At the limit of my knowledge on this, but am I running into grief 
because it''s PPPoE and not pure PPP?  Is there a good fix for this,
like
can we add a definition for DLT_LINUX_SLL in the lt[] array?

Many thanks for prompt help thusfar :-)

Tony

Tony and Robyn Lewis wrote:
> Moving right along (after using gcc-3.3, not gcc-4)
>
> If I try to run softflowd against my ppp0. I get a datalink error:
>
> me at mymachine:~/softflowd-0.9.7$ sudo ./softflowd -d -D -i ppp0 
> -nlocalhost:2205
> Unsupported datalink type 113
>
> My ppp0 is PPPoE.  In the header file, I see DLT_LINUX_SLL is 113, for 
> "Linux cooked sockets".
>
> At the limit of my knowledge on this, but am I running into grief 
> because it''s PPPoE and not pure PPP?  Is there a good fix for
this,
> like can we add a definition for DLT_LINUX_SLL in the lt[] array?
>
> Many thanks for prompt help thusfar :-)
Have hacked a bit and got it "working"

Added the following to the lt[] table:
        { DLT_LINUX_SLL,16, 14,  2,  1, 0xffffffff,  0x0800,   0x86dd },

This, after a comparative dump of what comes in.

However, it''s a messy hack, and i get the feel that cooked sockets are 
gonna be very variable in these parameters.

What''s an elegant solution?  Speculations:
 * have a "is a PPPoE" flag which then uses this definition
 * have a "--skiplen 16 --ft_off 14 --ft_len 2 (etc etc)" set of
flags,
or a "--flags=16,14,2,(etc etc)" flags
 * autodetect? maybe this is how tcpdump knows what to do

Tony

On Thu, 17 Nov 2005, Tony and Robyn Lewis wrote:
> Have hacked a bit and got it "working"
>
> Added the following to the lt[] table:
>        { DLT_LINUX_SLL,16, 14,  2,  1, 0xffffffff,  0x0800,   0x86dd },
>
> This, after a comparative dump of what comes in.
>
> However, it''s a messy hack, and i get the feel that cooked sockets
are
> gonna be very variable in these parameters.
>
> What''s an elegant solution?  Speculations:
> * have a "is a PPPoE" flag which then uses this definition
> * have a "--skiplen 16 --ft_off 14 --ft_len 2 (etc etc)" set of
flags,
> or a "--flags=16,14,2,(etc etc)" flags
> * autodetect? maybe this is how tcpdump knows what to do
I think a combination of the second and the third would be the most 
useful for the general case. tcpdump probably has code we can steal...

-d

Damien Miller wrote:
> On Thu, 17 Nov 2005, Tony and Robyn Lewis wrote:
>
>> Have hacked a bit and got it "working"
>>
>> Added the following to the lt[] table:
>>        { DLT_LINUX_SLL,16, 14,  2,  1, 0xffffffff,  0x0800,   0x86dd },
>>
>> This, after a comparative dump of what comes in.
>>
>> However, it''s a messy hack, and i get the feel that cooked
sockets are
>> gonna be very variable in these parameters.
>>
>> What''s an elegant solution?  Speculations:
>> * have a "is a PPPoE" flag which then uses this definition
>> * have a "--skiplen 16 --ft_off 14 --ft_len 2 (etc etc)" set
of flags,
>> or a "--flags=16,14,2,(etc etc)" flags
>> * autodetect? maybe this is how tcpdump knows what to do
>
>
> I think a combination of the second and the third would be the most 
> useful for the general case. tcpdump probably has code we can steal...
I''ve had more of a look.  According to 
http://oss.coresecurity.com/pcapy/doc/rn02re10.html (manpage for 
datalink() function), the datalink header for DLT_LINUX_SLL is a fixed 
format.  It''s always 16 bytes; the frametypes are the same as ethernet,
and always in the same spot.

So the attached patch should add ppp0 functionality to softflowd.

Tony Lewis


-------------- next part --------------
A non-text attachment was scrubbed...
Name: softflowd.c.DLT_LINUX_SLL.patch
Type: text/x-patch
Size: 513 bytes
Desc: not available
Url :
http://lists.mindrot.org/pipermail/netflow-tools/attachments/20051118/f44721a5/attachment.bin

On Fri, 18 Nov 2005, Tony and Robyn Lewis wrote:
> I''ve had more of a look.  According to 
> http://oss.coresecurity.com/pcapy/doc/rn02re10.html (manpage for datalink()
> function), the datalink header for DLT_LINUX_SLL is a fixed format. 
It''s
> always 16 bytes; the frametypes are the same as ethernet, and always in the
> same spot.
>
> So the attached patch should add ppp0 functionality to softflowd.
Patch applied, thanks!

-d