Added support for Loopback

salesforce · Dec 20, 2019 · 3fd191f · 3fd191f
1 parent cb29184
commit 3fd191f
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 0 deletions.
diff --git a/python/ja3.py b/python/ja3.py
@@ -148,6 +148,8 @@ def process_pcap(pcap, any_port=False):
     linktype = pcap.datalink()
     if linktype == dpkt.pcap.DLT_LINUX_SLL:
         decoder = dpkt.sll.SLL
+    elif linktype == dpkt.pcap.DLT_NULL or linktype == dpkt.pcap.DLT_LOOP:
+        decoder = dpkt.loopback.Loopback
 
     results = list()
     for timestamp, buf in pcap:

diff --git a/python/ja3/ja3.py b/python/ja3/ja3.py
@@ -147,6 +147,8 @@ def process_pcap(pcap, any_port=False):
     linktype = pcap.datalink()
     if linktype == dpkt.pcap.DLT_LINUX_SLL:
         decoder = dpkt.sll.SLL
+    elif linktype == dpkt.pcap.DLT_NULL or linktype == dpkt.pcap.DLT_LOOP:
+        decoder = dpkt.loopback.Loopback
 
     results = list()
     for timestamp, buf in pcap:

diff --git a/python/ja3s.py b/python/ja3s.py
@@ -132,6 +132,8 @@ def process_pcap(pcap, any_port=False):
     linktype = pcap.datalink()
     if linktype == dpkt.pcap.DLT_LINUX_SLL:
         decoder = dpkt.sll.SLL
+    elif linktype == dpkt.pcap.DLT_NULL or linktype == dpkt.pcap.DLT_LOOP:
+        decoder = dpkt.loopback.Loopback
 
     results = list()
     for timestamp, buf in pcap: