The definition of a "struct pcap_pkthdr" on OpenBSD contains a member
of type "struct bpf_timeval" instead of "struct timeval" used on other
systems.
Also, on OpenBSD the header netinet/if_ether.h does not #include
net/if_arp.h as it does on other systems.
Frame types except data and frames subtypes without payload are skipped.
Header length is determined based on presence of QoS and flags
indicating the use of the 4th address field. Handling of aggregated
MSDUs is explicitly prevented.
The link-layer addresses are now part of the connection endpoints
following the originator-responder-pattern. The addresses are printed
with leading zeros. Additionally link-layer addresses are also extracted
for 802.11 plus RadioTap.
BIT-1526 #merged
* origin/topic/seth/radiotap:
Improved Radiotap support and a test.
Fixed RadioTap support (still "Works for Me")
Initial commit of RadioTap encapsulation support)
Radiotap support should be fully functional now with Radiotap
packets that include IPv4 and IPv6. Other radiotap packets are
silently ignored. This includes a test which has 802.11 headers
both with and without QoS data.
* 'master' of https://github.com/aaronmbr/bro:
Copy-paste issue
Allow for logging of the VLAN data about a connection in conn.log
Save the inner vlan in the Packet object for Q-in-Q setups
