Packet structure

+---------------------------+
|        Protocol type      |
|         (2 Octets)        |
+---------------------------+
|       Reserved (MBZ)      |
|         (2 Octets)        |
+---------------------------+
|       Interface index     |
|         (4 Octets)        |
+---------------------------+
|        ARPHRD_ type       |
|         (2 Octets)        |
+---------------------------+
|         Packet type       |
|         (1 Octet)         |
+---------------------------+
| Link-layer address length |
|         (1 Octets)        |
+---------------------------+
|    Link-layer address     |
|         (8 Octets)        |
+---------------------------+
|           Payload         |
.                           .
.                           .
.                           .

Description

The protocol type field is in network byte order.

The ARPHRD_ type field is in network byte order; it contains a Linux ARPHRD_ value for the link-layer device type.

If the ARPHRD_ type is ARPHRD_IPGRE (778), the protocol type field contains a GRE protocol type.

If the ARPHRD_ type is ARPHRD_IEEE80211_RADIOTAP (803), the protocol type field is ignored, and the payload following the LINKTYPE_LINUX_SLL header begins with Radiotap link-layer information followed by an 802.11 header.

If the ARPHRD_ type is ARPHRD_FRAD (770), the protocol type field is ignored, and the payload following the LINKTYPE_LINUX_SLL header is a Frame Relay LAPF frame, beginning with a ITU-T Recommendation Q.922 LAPF header starting with the address field, and without an FCS at the end of the frame.

Otherwise, the protocol type field contains the Ethernet protocol type for the packet, or one of:

• 0x0001, if the frame is a Novell 802.3 frame without an 802.2 LLC header;
• 0x0003, in some mysterious cases;
• 0x0004, if the frame begins with an 802.2 LLC header;
• 0x000C, if the frame is a CAN bus frame that begins with a header of the form:

  +---------------------------+
  |      CAN ID and flags     |
  |         (4 Octets)        |
  +---------------------------+
  |    Frame payload length   |
  |         (1 Octet)         |
  +---------------------------+
  |          Padding          |
  |         (1 Octet)         |
  +---------------------------+
  |      Reserved/Padding     |
  |         (1 Octet)         |
  +---------------------------+
  |      Reserved/Padding     |
  |         (1 Octet)         |
  +---------------------------+
  

  where the field containing the CAN ID and flags is in host byte order. The bottom 29 bits contain the CAN ID of the frame. The remaining bits are:

  • 0x20000000 - set if the frame is an error message rather than a data frame;
  • 0x40000000 - set if the frame is a remote transmission request frame;
  • 0x80000000 - set if the frame is an extended 29-bit frame rather than a standard 11-bit frame;
  and the header is followed by the payload.
• 0x000D, if the frame is a CAN FD (CAN with Flexible Data-Rate) frame that begins with a header of the form:

  +---------------------------+
  |      CAN ID and flags     |
  |         (4 Octets)        |
  +---------------------------+
  |    Frame payload length   |
  |         (1 Octet)         |
  +---------------------------+
  |         FD flags          |
  |         (1 Octet)         |
  +---------------------------+
  |      Reserved/Padding     |
  |         (1 Octet)         |
  +---------------------------+
  |      Reserved/Padding     |
  |         (1 Octet)         |
  +---------------------------+
  

  where the field containing the CAN ID and flags is in host byte order. The bottom 29 bits of that field contain the CAN ID of the frame. The remaining bits are:

  • 0x80000000 - set if the frame is an extended 29-bit frame rather than a standard 11-bit frame.
  The bits of the FD flags field are:
  • 0x01 - set if the bit rate switch flag is set for the frame;
  • 0x02 - set if the error state indicator is set for the frame;
  and the header is followed by the payload.

The "Reserved (MBZ)" field is reserved, and must be set to zero.

The interface index field is a signed integer in network byte order and contains the 1-based index of the interface on which the packet was observed.

The packet type field contains a value that is one of:

• 0, if the packet was specifically sent to us by somebody else;
• 1, if the packet was broadcast by somebody else;
• 2, if the packet was multicast, but not broadcast, by somebody else;
• 3, if the packet was sent to somebody else by somebody else;
• 4, if the packet was sent by us.

The link-layer address length field contains the length of the link-layer address of the sender of the packet. That length could be zero.

The link-layer address field contains the link-layer address of the sender of the packet; the number of bytes of that field that are meaningful is specified by the link-layer address length field. If there are more than 8 bytes, only the first 8 bytes are present, and if there are fewer than 8 bytes, there are padding bytes after the address to pad the field to 8 bytes.