Linux “Cooked” Capture Encapsulation¶

pcapkit.protocols.link.linux_sll1 contains LinuxSLL1 only, which implements the extractor for the Linux “cooked” capture encapsulation [*] of LINKTYPE_LINUX_SLL – the header every tcpdump -i any capture on Linux uses – whose structure is described as below:

Octets	Bits	Name	Description
0	0	`linux_sll.packet_type`	Packet Type
2	16	`linux_sll.arphrd_type`	ARP Hardware Type
4	32	`linux_sll.link_addr_length`	Link-Layer Address Length
6	48	`linux_sll.link_addr`	Link-Layer Address (padded)
14	112	`linux_sll.protocol_type`	Protocol (Internet Layer)

Next-layer dispatch is shared with LinuxSLL2; see linux_sll. Its id() is ('LinuxSLL1',), and its alias is 'LINUX_SLL1'; see Selecting a Version.

class pcapkit.protocols.link.linux_sll1.LinuxSLL1(file=None, length=None, **kwargs)[source]¶

Bases: LinuxSLL[LinuxSLL1, LinuxSLL1]

Linux “cooked” capture encapsulation v1 (LINUX_SLL).

protocol_type is dispatched as an EtherType, unless arphrd_type is a key of LinuxSLL.__proto__, which dispatches it instead; with no dissector registered either way, the payload is Raw.

property name: Literal['Linux cooked capture encapsulation']¶: Name of current protocol.

property alias: Literal['LINUX_SLL1']¶: Acronym of corresponding protocol.

property info_name: Literal['linux_sll']¶: Key name of the info dict.

property length: Literal[16]¶: Header length of current protocol.

property protocol: int¶: Protocol (internet layer) of next layer protocol.

classmethod id()[source]¶

Index ID of the protocol.

Return type:: tuple[Literal['LinuxSLL1']]
Returns:: Index ID of the protocol, this version’s own name.

read(length=None, **kwargs)[source]¶

Read Linux “cooked” capture encapsulation.

Structure of the LINUX_SLL header:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Packet Type          |         ARPHRD Type           |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|      Link-Layer Addr Length   |     Link-Layer Address...     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                 ...Link-Layer Address (padded)                |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Protocol Type        |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Parameters:

length (int | None) – Length of packet data.
**kwargs (Any) – Arbitrary keyword arguments.

Return type:

LinuxSLL1

Returns:

Parsed packet data.

make(packet_type=0, arphrd_type=Hardware.Ethernet, link_addr=b'', link_addr_length=None, protocol_type=EtherType.Internet_Protocol_version_4, payload=b'', **kwargs)[source]¶

Make (construct) packet data.

Parameters:

packet_type (int) – Packet type (direction).
arphrd_type (Hardware | int) – ARP hardware type of the interface the packet was seen on.
link_addr (bytes | bytearray) – Link-layer address, at most 8 octets; padded with NUL octets to 8 if shorter.
link_addr_length (int | None) – Length of the address actually in use, by default len(link_addr); may exceed 8, up to 0xFFFF.
protocol_type (EtherType | int) – Protocol (internet layer); an EtherType unless arphrd_type is a key of LinuxSLL.__proto__.
payload (bytes | ProtocolBase | Schema) – Payload data.
**kwargs (Any) – Arbitrary keyword arguments.

Return type:

LinuxSLL1

Returns:

Constructed packet data.

Raises:

ProtocolError – If link_addr does not fit in 8 octets, or link_addr_length is given outside 0 to 0xFFFF; or if arphrd_type or protocol_type is a name, a bool, or a member or code its field cannot carry.

classmethod _make_data(data)[source]¶

Create key-value pairs from data for protocol construction.

Parameters:: data (LinuxSLL1) – protocol data
Return type:: dict[str, Any]
Returns:: Key-value pairs for protocol construction.

classmethod __index__()[source]¶

Numeral registry index of the protocol.

Return type:: LinkType
Returns:: Numeral registry index of the protocol in tcpdump link-layer header types.

Header Schemas¶

class pcapkit.protocols.schema.link.linux_sll1.LinuxSLL1(packet_type=NO_VALUE, arphrd_type=NO_VALUE, link_addr_length=NO_VALUE, link_addr=NO_VALUE, protocol_type=NO_VALUE, payload=NO_VALUE, *, __packet__=None, **kwargs)[source]¶

Bases: Schema

Header schema for Linux “cooked” capture encapsulation (LINUX_SLL, v1).

protocol_type is kept as its raw 2 octets here; whether it is an EtherType depends on arphrd_type, see LinuxSLL1.

packet_type: int = <UInt16Field packet_type>¶: Packet type (direction).

arphrd_type: Hardware = <EnumField arphrd_type>¶: ARP hardware type of the interface the packet was seen on.

link_addr_length: int = <UInt16Field link_addr_length>¶: Link-layer address length actually in use; may exceed 8.

link_addr: bytes = <BytesField link_addr>¶: Link-layer address, padded to 8 octets; only the first min(link_addr_length, 8) of them are meaningful.

protocol_type: int = <UInt16Field protocol_type>¶: Protocol (internet layer).

payload: bytes = <PayloadField payload>¶: Payload.

Data Models¶

class pcapkit.protocols.data.link.linux_sll1.LinuxSLL1(packet_type, arphrd_type, link_addr_length, link_addr, protocol_type)[source]¶

Bases: Protocol

Data model for Linux “cooked” capture encapsulation (LINUX_SLL, v1).

protocol_type is an EtherType for every arphrd_type except a few – see LinuxSLL1; it is kept as its raw wire value here regardless.

packet_type: int¶: Packet type (direction), where 0 is to us, 1 broadcast, 2 multicast, 3 sent to another host promiscuously and 4 sent by us.

arphrd_type: Hardware¶: ARP hardware type of the interface the packet was seen on.

link_addr_length: int¶: Link-layer address length actually in use; may exceed 8.

link_addr: bytes¶: Link-layer address, padded to 8 octets as captured; only the first link_addr_length of them are meaningful.

protocol_type: int¶: Protocol (internet layer), kept as its raw wire value.

Footnotes