diff --git a/include/packet_writer.h b/include/packet_writer.h index 7c0ad4d..8ea8c05 100644 --- a/include/packet_writer.h +++ b/include/packet_writer.h @@ -55,6 +55,7 @@ public: RADIOTAP = DLT_IEEE802_11_RADIO, DOT11 = DLT_IEEE802_11, ETH2 = DLT_EN10MB, + DOT3 = DLT_EN10MB, SLL = DLT_LINUX_SLL }; diff --git a/include/sniffer.h b/include/sniffer.h index 6f4a6e8..ab25d4a 100644 --- a/include/sniffer.h +++ b/include/sniffer.h @@ -42,6 +42,7 @@ #include "packet.h" #include "loopback.h" #include "dot11.h" +#include "dot3.h" #include "sll.h" #include "cxxstd.h" #include "exceptions.h" @@ -221,6 +222,9 @@ namespace Tins { BaseSniffer(const BaseSniffer&); BaseSniffer &operator=(const BaseSniffer&); + static bool is_dot3(const uint8_t *ptr, size_t sz) { + return (sz >= 13 && ptr[12] < 8); + } template static bool call_functor(LoopData *data, const u_char *packet, const struct pcap_pkthdr *header); @@ -299,8 +303,11 @@ namespace Tins { PCapLoopBreaker _(ret_val, data->handle); try { Internals::smart_ptr::type pdu; - if(data->iface_type == DLT_EN10MB) - ret_val = call_functor(data, packet, header); + if(data->iface_type == DLT_EN10MB) { + ret_val = is_dot3((const uint8_t*)packet, header->caplen) ? + call_functor(data, packet, header) : + call_functor(data, packet, header); + } else if(data->iface_type == DLT_IEEE802_11_RADIO) ret_val = call_functor(data, packet, header); else if(data->iface_type == DLT_IEEE802_11) { diff --git a/src/sniffer.cpp b/src/sniffer.cpp index e8f9fc8..3bd81c0 100644 --- a/src/sniffer.cpp +++ b/src/sniffer.cpp @@ -70,8 +70,12 @@ PtrPacket BaseSniffer::next_packet() { // timestamp_ = header.ts; if(content) { try { - if(iface_type == DLT_EN10MB) - ret = new EthernetII((const uint8_t*)content, header.caplen); + if(iface_type == DLT_EN10MB) { + if(is_dot3((const uint8_t*)content, header.caplen)) + ret = new Dot3((const uint8_t*)content, header.caplen); + else + ret = new EthernetII((const uint8_t*)content, header.caplen); + } else if(iface_type == DLT_IEEE802_11_RADIO) ret = new RadioTap((const uint8_t*)content, header.caplen); else if(iface_type == DLT_IEEE802_11)