/*- * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 *	The Regents of the University of California.  All rights reserved. * * This code is derived from the Stanford/CMU enet packet filter, * (net/enet.c) distributed as part of 4.3BSD, and code contributed * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence  * Berkeley Laboratory. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright *    notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright *    notice, this list of conditions and the following disclaimer in the *    documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software *    must display the following acknowledgement: *      This product includes software developed by the University of *      California, Berkeley and its contributors. * 4. Neither the name of the University nor the names of its contributors *    may be used to endorse or promote products derived from this software *    without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * *      @(#)bpf.h       7.1 (Berkeley) 5/7/91 * * @(#) $Header: /tcpdump/master/libpcap/pcap-bpf.h,v 1.9.2.9 2004/03/28 21:45:32 fenner Exp $ (LBL) *//* * This is libpcap's cut-down version of bpf.h; it includes only * the stuff needed for the code generator and the userland BPF * interpreter, and the libpcap APIs for setting filters, etc.. * * "pcap-bpf.c" will include the native OS version, as it deals with * the OS's BPF implementation. * * XXX - should this all just be moved to "pcap.h"? */#ifndef BPF_MAJOR_VERSION#ifdef __cplusplusextern "C" {#endif/* BSD style release date */#define BPF_RELEASE 199606typedef	int bpf_int32;typedef	u_int bpf_u_int32;/* * Alignment macros.  BPF_WORDALIGN rounds up to the next  * even multiple of BPF_ALIGNMENT.  */#ifndef __NetBSD__#define BPF_ALIGNMENT sizeof(bpf_int32)#else#define BPF_ALIGNMENT sizeof(long)#endif#define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))#define BPF_MAXINSNS 512#define BPF_MAXBUFSIZE 0x8000#define BPF_MINBUFSIZE 32/* * Structure for "pcap_compile()", "pcap_setfilter()", etc.. */struct bpf_program {	u_int bf_len;	struct bpf_insn *bf_insns;	int index; /*combrio add*/}; /* * Struct return by BIOCVERSION.  This represents the version number of  * the filter language described by the instruction encodings below. * bpf understands a program iff kernel_major == filter_major && * kernel_minor >= filter_minor, that is, if the value returned by the * running kernel has the same major number and a minor number equal * equal to or less than the filter being downloaded.  Otherwise, the * results are undefined, meaning an error may be returned or packets * may be accepted haphazardly. * It has nothing to do with the source code version. */struct bpf_version {	u_short bv_major;	u_short bv_minor;};/* Current version number of filter architecture. */#define BPF_MAJOR_VERSION 1#define BPF_MINOR_VERSION 1/* * Data-link level type codes. * * Do *NOT* add new values to this list without asking * "tcpdump-workers@tcpdump.org" for a value.  Otherwise, you run the * risk of using a value that's already being used for some other purpose, * and of having tools that read libpcap-format captures not being able * to handle captures with your new DLT_ value, with no hope that they * will ever be changed to do so (as that would destroy their ability * to read captures using that value for that other purpose). *//* * These are the types that are the same on all platforms, and that * have been defined by <net/bpf.h> for ages. */#define DLT_NULL	0	/* no link-layer encapsulation */#define DLT_EN10MB	1	/* Ethernet (10Mb) */#define DLT_EN3MB	2	/* Experimental Ethernet (3Mb) */#define DLT_AX25	3	/* Amateur Radio AX.25 */#define DLT_PRONET	4	/* Proteon ProNET Token Ring */#define DLT_CHAOS	5	/* Chaos */#define DLT_IEEE802	6	/* IEEE 802 Networks */#define DLT_ARCNET	7	/* ARCNET, with BSD-style header */#define DLT_SLIP	8	/* Serial Line IP */#define DLT_PPP		9	/* Point-to-point Protocol */#define DLT_FDDI	10	/* FDDI *//* * These are types that are different on some platforms, and that * have been defined by <net/bpf.h> for ages.  We use #ifdefs to * detect the BSDs that define them differently from the traditional * libpcap <net/bpf.h> * * XXX - DLT_ATM_RFC1483 is 13 in BSD/OS, and DLT_RAW is 14 in BSD/OS, * but I don't know what the right #define is for BSD/OS. */#define DLT_ATM_RFC1483	11	/* LLC/SNAP encapsulated atm */#ifdef __OpenBSD__#define DLT_RAW		14	/* raw IP */#else#define DLT_RAW		12	/* raw IP */#endif/* * Given that the only OS that currently generates BSD/OS SLIP or PPP * is, well, BSD/OS, arguably everybody should have chosen its values * for DLT_SLIP_BSDOS and DLT_PPP_BSDOS, which are 15 and 16, but they * didn't.  So it goes. */#if defined(__NetBSD__) || defined(__FreeBSD__)#ifndef DLT_SLIP_BSDOS#define DLT_SLIP_BSDOS	13	/* BSD/OS Serial Line IP */#define DLT_PPP_BSDOS	14	/* BSD/OS Point-to-point Protocol */#endif#else#define DLT_SLIP_BSDOS	15	/* BSD/OS Serial Line IP */#define DLT_PPP_BSDOS	16	/* BSD/OS Point-to-point Protocol */#endif/* * 17 is used for DLT_OLD_PFLOG in OpenBSD; *     OBSOLETE: DLT_PFLOG is 117 in OpenBSD now as well. See below. * 18 is used for DLT_PFSYNC in OpenBSD; don't use it for anything else. */#define DLT_ATM_CLIP	19	/* Linux Classical-IP over ATM *//* * These values are defined by NetBSD; other platforms should refrain from * using them for other purposes, so that NetBSD savefiles with link * types of 50 or 51 can be read as this type on all platforms. */#define DLT_PPP_SERIAL	50	/* PPP over serial with HDLC encapsulation */#define DLT_PPP_ETHER	51	/* PPP over Ethernet *//* * The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses * a link-layer type of 99 for the tcpdump it supplies.  The link-layer * header has 6 bytes of unknown data, something that appears to be an * Ethernet type, and 36 bytes that appear to be 0 in at least one capture * I've seen. */#define DLT_SYMANTEC_FIREWALL	99/* * Values between 100 and 103 are used in capture file headers as * link-layer types corresponding to DLT_ types that differ * between platforms; don't use those values for new DLT_ new types. *//* * This value was defined by libpcap 0.5; platforms that have defined * it with a different value should define it here with that value - * a link type of 104 in a save file will be mapped to DLT_C_HDLC, * whatever value that happens to be, so programs will correctly * handle files with that link type regardless of the value of * DLT_C_HDLC. * * The name DLT_C_HDLC was used by BSD/OS; we use that name for source * compatibility with programs written for BSD/OS. * * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well, * for source compatibility with programs written for libpcap 0.5. */#define DLT_C_HDLC	104	/* Cisco HDLC */#define DLT_CHDLC	DLT_C_HDLC#define DLT_IEEE802_11	105	/* IEEE 802.11 wireless *//* * 106 is reserved for Linux Classical IP over ATM; it's like DLT_RAW, * except when it isn't.  (I.e., sometimes it's just raw IP, and * sometimes it isn't.)  We currently handle it as DLT_LINUX_SLL, * so that we don't have to worry about the link-layer header.) *//* * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides * with other values. * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header * (DLCI, etc.). */#define DLT_FRELAY	107/* * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except * that the AF_ type in the link-layer header is in network byte order. * * OpenBSD defines it as 12, but that collides with DLT_RAW, so we * define it as 108 here.  If OpenBSD picks up this file, it should * define DLT_LOOP as 12 in its version, as per the comment above - * and should not use 108 as a DLT_ value. */#define DLT_LOOP	108/* * Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's * DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other * than OpenBSD. */#ifdef __OpenBSD__#define DLT_ENC		13#else#define DLT_ENC		109#endif/* * Values between 110 and 112 are reserved for use in capture file headers * as link-layer types corresponding to DLT_ types that might differ * between platforms; don't use those values for new DLT_ types * other than the corresponding DLT_ types. *//* * This is for Linux cooked sockets. */#define DLT_LINUX_SLL	113/* * Apple LocalTalk hardware. */#define DLT_LTALK	114/* * Acorn Econet. */#define DLT_ECONET	115/* * Reserved for use with OpenBSD ipfilter. */#define DLT_IPFILTER	116/* * OpenBSD DLT_PFLOG; DLT_PFLOG is 17 in OpenBSD, but that's DLT_LANE8023 * in SuSE 6.3, so we can't use 17 for it in capture-file headers. * * XXX: is there a conflict with DLT_PFSYNC 18 as well? */#ifdef __OpenBSD__#define DLT_OLD_PFLOG	17#define DLT_PFSYNC	18#endif#define DLT_PFLOG	117/* * Registered for Cisco-internal use. */#define DLT_CISCO_IOS	118