Permalink
Browse files

fixed: snort(DAQ) in nfq mode and probably ipfw would issue packets w…

…ith DLT_IPV4 (228) and DLT_IPV6 (229) datalink type, leading to a decoding error and errornous logging of the event.
  • Loading branch information...
1 parent 9820c15 commit f5cdf5ccb910b9054318f3d4649186cb531cbc1d @binf binf committed with Sep 1, 2011
Showing with 7 additions and 9 deletions.
  1. +7 −9 src/decode.c
View
@@ -216,25 +216,23 @@ int DecodePacket(int linktype, Packet *p, const struct pcap_pkthdr *pkthdr, cons
DecodeNullPkt(p, pkthdr, pkt);
break;
-#ifdef DLT_RAW /* Not supported in some arch or older pcap
- * versions */
+
+#ifdef DLT_RAW
case DLT_RAW:
-#ifdef DLT_IPV4
- case DLT_IPV4:
-#endif
-#ifdef DLT_IPV6
- case DLT_IPV6:
#endif
+ case 228: /*Defined in some bpf implementation as DLT_IPV4: */
+ case 229: /* Defined in some bpf implementation as DLT_IPV6 */
+
if (BcOutputDataLink())
{
LogMessage("There's no second layer header available for "
- "this datalink\n");
+ "this datalink\n");
barnyard2_conf->output_flags &= ~OUTPUT_FLAG__SHOW_DATA_LINK;
}
DecodeRawPkt(p, pkthdr, pkt);
break;
-#endif
+
/*
* you need the I4L modified version of libpcap to get this stuff
* working

0 comments on commit f5cdf5c

Please sign in to comment.