-
Guy Harris authored
Those frames *don't* have their link-layer headers stripped, even on PF_PACKET/SOCK_DGRAM captures (hopefully, nobody will consider that a bug and "fix" it). The "hatype" field is the ARPHRD_ value for the adapter, as returned by SIOCGIFHWADDR; in monitor mode, those frames will have an hatype of ARPHRD_IEEE80211_RADIOTAP. Add an "sll.hatype" dissector table, which we check before checking the "sll.ltype" dissector table, and have the radiotap dissector register in that table. We still use the special hack for an hatype of ARPHRD_NETLINK, because, for *those* frames, the "protocol" field of the nominal SLL header is the netlink family, not an Ethertype or anything else that the SLL dissector would handle. Change-Id: If503a7daa9133adf1b8c330ec28c4c824d4f551d Reviewed-on: https://code.wireshark.org/review/30592 Reviewed-by: Guy Harris <guy@alum.mit.edu>
c348dd4b