Linux “Cooked” Capture Encapsulation v2¶

pcapkit.protocols.link.linux_sll2 contains LinuxSLL2 only, which implements the extractor for the Linux “cooked” capture encapsulation v2 [*] of LINKTYPE_LINUX_SLL2, whose structure is described as below:

Octets	Bits	Name	Description
0	0	`linux_sll2.protocol_type`	Protocol (Internet Layer)
2	16	`linux_sll2.reserved`	Reserved
4	32	`linux_sll2.interface_index`	Interface Index
8	64	`linux_sll2.arphrd_type`	ARP Hardware Type
10	80	`linux_sll2.packet_type`	Packet Type
11	88	`linux_sll2.link_addr_length`	Link-Layer Address Length
12	96	`linux_sll2.link_addr`	Link-Layer Address (padded)

Unlike v1, protocol_type comes first, interface_index is new, and packet_type and link_addr_length are 1 octet rather than 2. See LinuxSLL1 for v1; next-layer dispatch is shared, see linux_sll. Its id() is ('LinuxSLL2',), and its alias is 'LINUX_SLL2'; see Selecting a Version.

class pcapkit.protocols.link.linux_sll2.LinuxSLL2(file=None, length=None, **kwargs)[source]¶

Bases: LinuxSLL[LinuxSLL2, LinuxSLL2]

Linux “cooked” capture encapsulation v2 (LINUX_SLL2).

Next-layer dispatch is that of LinuxSLL1.

property name: Literal['Linux cooked capture encapsulation v2']¶: Name of current protocol.

property alias: Literal['LINUX_SLL2']¶: Acronym of corresponding protocol.

property info_name: Literal['linux_sll2']¶: Key name of the info dict.

property length: Literal[20]¶: Header length of current protocol.

property protocol: int¶: Protocol (internet layer) of next layer protocol.

classmethod id()[source]¶

Index ID of the protocol.

Return type:: tuple[Literal['LinuxSLL2']]
Returns:: Index ID of the protocol, this version’s own name.

read(length=None, **kwargs)[source]¶

Read Linux “cooked” capture encapsulation v2.

Structure of the LINUX_SLL2 header:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Protocol Type        |            Reserved           |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                        Interface Index                       |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          ARPHRD Type          |Packet Type|Link-Addr Length|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                 Link-Layer Address (padded)                  |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Parameters:

length (int | None) – Length of packet data.
**kwargs (Any) – Arbitrary keyword arguments.

Return type:

LinuxSLL2

Returns:

Parsed packet data.

make(protocol_type=EtherType.Internet_Protocol_version_4, reserved=0, interface_index=0, arphrd_type=Hardware.Ethernet, packet_type=0, link_addr=b'', link_addr_length=None, payload=b'', **kwargs)[source]¶

Make (construct) packet data.

Parameters:

protocol_type (EtherType | int) – Protocol (internet layer); an EtherType unless arphrd_type is a key of LinuxSLL.__proto__.
reserved (int) – Reserved, must be zero.
interface_index (int) – Index, in the capturing host’s own numbering, of the interface the packet was seen on.
arphrd_type (Hardware | int) – ARP hardware type of the interface the packet was seen on.
packet_type (int) – Packet type (direction).
link_addr (bytes | bytearray) – Link-layer address, at most 8 octets; padded with NUL octets to 8 if shorter.
link_addr_length (int | None) – Length of the address actually in use, by default len(link_addr); may exceed 8, up to 0xFF.
payload (bytes | ProtocolBase | Schema) – Payload data.
**kwargs (Any) – Arbitrary keyword arguments.

Return type:

LinuxSLL2

Returns:

Constructed packet data.

Raises:

ProtocolError – If link_addr does not fit in 8 octets, or link_addr_length is given outside 0 to 0xFF; or if protocol_type or arphrd_type is a name, a bool, or a member or code its field cannot carry.

classmethod _make_data(data)[source]¶

Create key-value pairs from data for protocol construction.

Parameters:: data (LinuxSLL2) – protocol data
Return type:: dict[str, Any]
Returns:: Key-value pairs for protocol construction.

classmethod __index__()[source]¶

Numeral registry index of the protocol.

Return type:: LinkType
Returns:: Numeral registry index of the protocol in tcpdump link-layer header types.

Header Schemas¶

class pcapkit.protocols.schema.link.linux_sll2.LinuxSLL2(protocol_type=NO_VALUE, reserved=NO_VALUE, interface_index=NO_VALUE, arphrd_type=NO_VALUE, packet_type=NO_VALUE, link_addr_length=NO_VALUE, link_addr=NO_VALUE, payload=NO_VALUE, *, __packet__=None, **kwargs)[source]¶

Bases: Schema

Header schema for Linux “cooked” capture encapsulation v2 (LINUX_SLL2).

The field order and widths differ from v1 – protocol_type moves to the front, interface_index is new, and packet_type / link_addr_length shrink from 2 octets to 1 – see LinuxSLL1 for v1.

protocol_type: int = <UInt16Field protocol_type>¶: Protocol (internet layer).

reserved: int = <UInt16Field reserved>¶: Reserved, must be zero.

interface_index: int = <UInt32Field interface_index>¶: Index, in the capturing host’s own numbering, of the interface the packet was seen on.

arphrd_type: Hardware = <EnumField arphrd_type>¶: ARP hardware type of the interface the packet was seen on.

packet_type: int = <UInt8Field packet_type>¶: Packet type (direction).

link_addr_length: int = <UInt8Field link_addr_length>¶: Link-layer address length actually in use; may exceed 8.

link_addr: bytes = <BytesField link_addr>¶: Link-layer address, padded to 8 octets; only the first min(link_addr_length, 8) of them are meaningful.

payload: bytes = <PayloadField payload>¶: Payload.

Data Models¶

class pcapkit.protocols.data.link.linux_sll2.LinuxSLL2(protocol_type, reserved, interface_index, arphrd_type, packet_type, link_addr_length, link_addr)[source]¶

Bases: Protocol

Data model for Linux “cooked” capture encapsulation v2 (LINUX_SLL2).

protocol_type is an EtherType for every arphrd_type except a few – see LinuxSLL2; it is kept as its raw wire value here regardless.

protocol_type: int¶: Protocol (internet layer), kept as its raw wire value.

reserved: int¶: Reserved, must be zero.

interface_index: int¶: Index, in the capturing host’s own numbering, of the interface the packet was seen on.

arphrd_type: Hardware¶: ARP hardware type of the interface the packet was seen on.

packet_type: int¶: Packet type (direction), where 0 is to us, 1 broadcast, 2 multicast, 3 sent to another host promiscuously and 4 sent by us.

link_addr_length: int¶: Link-layer address length actually in use; may exceed 8.

link_addr: bytes¶: Link-layer address, padded to 8 octets as captured; only the first link_addr_length of them are meaningful.

Footnotes