google / google/gopacket

pcap.CompileBPFFilter DLT/LINKTYPE confusion

Open
#910 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Go
Stars
6.8k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

`pcap.CompileBPFFilter` claims to accept `layers.LinkType` type, which corresponds to `LINKTYPE_*` constants in libpcap.

This is unfortunately wrong, as libpcap actually expects `DLT_*` constants here.

For example, trying to pass `layers.LinkTypeRaw` results in `unknown data link type 101` (`LINKTYPE_RAW`) error. You should pass pass 12 here (`DLT_RAW`).

```go
package main

import (
"fmt"

"github.com/google/gopacket/layers"
"github.com/google/gopacket/pcap"
)

func main() {
for _, linkType := range []layers.LinkType{layers.LinkType(12), layers.LinkTypeRaw} {
_, err := pcap.CompileBPFFilter(linkType, 0x10000, "tcp port 80")
fmt.Printf("%s (val=%d) err=%v\n", linkType, linkType, err)
}
}
```

```
Raw (val=12) err=
Raw (val=101) err=unknown data link type 101
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.