79425212

Date: 2025-02-09 16:11:09
Score: 2.5
Natty:
Report link

I'm guessing mixing different link-layer type into a single pcap_dumper_t is probably not a good idea

"Not a good idea" as in "impossible", to be precise.

A pcap_dumper_t can have only one link-layer type because it writes out a pcap file, which has only one link-layer type recorded in the file's header. That means that all packets in that file will be interpreted by programs reading that file (tcpdump, Wireshark, etc.) as if they had the link-layer type. For example, if the type is LINKTYPE_ETHERNET/DLT_EN10MB, all packets will be interpreted as if they were Ethernet packet, even if they aren't, so all non-Ethernet packets, such as LINKTYPE_LINUX_SLL/DLT_LINUX_SLL packets, will be misinterpreted.

is there any good practices for my use case ? For instance should I check that all my interfaces uses the same link-layer to prevent dump issues ?

Yes, you should.

is there a way to convert a packet into a particular link-layer format before dump ?

No simple way. If your software knows the format of the link-layer headers for all the link-layer format, you may be able to remove non-matching link-layer headers and add a matching link-layer header. It might be straightforward to convert LINKTYPE_ETHERNET/DLT_EN10MB packets to LINKTYPE_LINUX_SLL/DLT_LINUX_SLL packets, for example.

would the pcapng format be useful in my case ?

Yes.

but it seems libpcap is only able to read pcapng and not write it.

Yes. You would have to write your own code to write pcapng files.

Reasons:
  • Blacklisted phrase (1): is there a way
  • Blacklisted phrase (1): is there any
  • Long answer (-1):
  • Has code block (-0.5):
  • Contains question mark (0.5):
  • Unregistered user (0.5):
  • Low reputation (1):
Posted by: user29571306