can't decode packet with link-type LINUX_SLL2

curu commented 1 year ago

when parsing packet captured with -iany on almalinux 9, it emits decode error:

sample code:

    handle, err := pcap.OpenOffline(pcapFile)
    if err != nil {
        log.Fatal(err)
    }   
    defer handle.Close()

    packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
    for packet := range packetSource.Packets() {
        log.Printf("%s\n", packet.Dump())
        break

output:

2023/04/04 20:08:24 -- FULL PACKET DATA (80 bytes) ------------------------------------
00000000  08 00 00 00 00 00 00 02  00 01 04 06 52 54 00 66  |............RT.f|
....
--- Layer 1 ---
DecodeFailure   Packet decoding error: Unable to decode LinkType 20
00000000  08 00 00 00 00 00 00 02  00 01 04 06 52 54 00 66  |............RT.f|
...

it seems that's because there's no LinkTypeLinuxSLL2 support.
@gconnell

migounette commented 2 months ago

Did you find a solution for https://www.tcpdump.org/linktypes/LINKTYPE_LINUX_SLL2.html I can write the missing layer, but it seems that the project is in hold ?

dharmesh404 commented 2 weeks ago

any updates on this issue ?

google / gopacket

can't decode packet with link-type LINUX_SLL2 #1109