LINKTYPE_LINUX_SLL2
Packet structure
+---------------------------+ | Protocol type | | (2 Octets) | +---------------------------+ | Reserved (MBZ) | | (2 Octets) | +---------------------------+ | Interface index | | (4 Octets) | +---------------------------+ | ARPHRD_ type | | (2 Octets) | +---------------------------+ | Packet type | | (1 Octet) | +---------------------------+ | Link-layer address length | | (1 Octets) | +---------------------------+ | Link-layer address | | (8 Octets) | +---------------------------+ | Payload | . . . . . .
Description
The protocol type field is in network byte order.
The ARPHRD_
type field is in network byte order; it contains a Linux
ARPHRD_
value for the link-layer device type.
If the ARPHRD_
type is ARPHRD_IPGRE
(778), the protocol type field
contains a GRE
protocol type.
If the ARPHRD_
type is ARPHRD_IEEE80211_RADIOTAP
(803), the protocol
type field is ignored, and the payload following the LINKTYPE_LINUX_SLL
header begins with Radiotap
link-layer information followed by an 802.11 header.
If the ARPHRD_
type is ARPHRD_FRAD
(770), the protocol type field is
ignored, and the payload following the LINKTYPE_LINUX_SLL
header is a
Frame Relay LAPF frame, beginning with a ITU-T Recommendation
Q.922 LAPF header starting with the address field, and without an
FCS at the end of the frame.
Otherwise, the protocol type field contains the Ethernet protocol type for the packet, or one of:
0x0001
, if the frame is a Novell 802.3 frame without an 802.2 LLC header;0x0003
, in some mysterious cases;0x0004
, if the frame begins with an 802.2 LLC header;0x000C
, if the frame is a CAN bus frame that begins with a header of the form:+---------------------------+ | CAN ID and flags | | (4 Octets) | +---------------------------+ | Frame payload length | | (1 Octet) | +---------------------------+ | Padding | | (1 Octet) | +---------------------------+ | Reserved/Padding | | (1 Octet) | +---------------------------+ | Reserved/Padding | | (1 Octet) | +---------------------------+
where the field containing the CAN ID and flags is in host byte order. The bottom 29 bits contain the CAN ID of the frame. The remaining bits are:
0x20000000
- set if the frame is an error message rather than a data frame;0x40000000
- set if the frame is a remote transmission request frame;0x80000000
- set if the frame is an extended 29-bit frame rather than a standard 11-bit frame;
0x000D
, if the frame is a CAN FD (CAN with Flexible Data-Rate) frame that begins with a header of the form:+---------------------------+ | CAN ID and flags | | (4 Octets) | +---------------------------+ | Frame payload length | | (1 Octet) | +---------------------------+ | FD flags | | (1 Octet) | +---------------------------+ | Reserved/Padding | | (1 Octet) | +---------------------------+ | Reserved/Padding | | (1 Octet) | +---------------------------+
where the field containing the CAN ID and flags is in host byte order. The bottom 29 bits of that field contain the CAN ID of the frame. The remaining bits are:
0x80000000
- set if the frame is an extended 29-bit frame rather than a standard 11-bit frame.
0x01
- set if the bit rate switch flag is set for the frame;0x02
- set if the error state indicator is set for the frame;
The "Reserved (MBZ)" field is reserved, and must be set to zero.
The interface index field is a signed integer in network byte order and contains the 1-based index of the interface on which the packet was observed.
The packet type field contains a value that is one of:
- 0, if the packet was specifically sent to us by somebody else;
- 1, if the packet was broadcast by somebody else;
- 2, if the packet was multicast, but not broadcast, by somebody else;
- 3, if the packet was sent to somebody else by somebody else;
- 4, if the packet was sent by us.
The link-layer address length field contains the length of the link-layer address of the sender of the packet. That length could be zero.
The link-layer address field contains the link-layer address of the sender of the packet; the number of bytes of that field that are meaningful is specified by the link-layer address length field. If there are more than 8 bytes, only the first 8 bytes are present, and if there are fewer than 8 bytes, there are padding bytes after the address to pad the field to 8 bytes.