size (via BIOCSBLEN). Obtained from FreeBSD 4.x; originally from
http://www.tcpdump.org's version of libpcap.
Taken verbatim from the FreeBSD 4.9 version, lint and all, other than
increasing the maximum size from 32Kibyte to an extremely generous
4Mibytes. We assume root will configure the in-kernel maximum value
sensibly on small-memory machines.
* When opening a live pcap, obtain the list of supported DLTs from
the BPF.
* Add pcap_list_datalinks() to obtain a list of supported DLTs
supported by the interface associated with the pcap descriptor.
* Add pcap_set_datalink() to set the current DLT of the pcap.
* Bump shlib 1.2 -> 1.3; new functions added.
From David Young <dyoung@ojctech.com>, with some minor changes by me.
"tcp" will match both IPv4 TCP and IPv6 TCP.
"ip6" will match IPv6.
you can chase header chain by using "protochain" instead of "proto"
(but bpf code is not optimizable in this case)
commit to tcpdump will follow.
I've sent this fix to LBL guys to get no response. I wonder why it was.
dyoung