Pastebin launched a little side project called VERYVIRAL.com, check it out ;-) Want more features on Pastebin? Sign Up, it's FREE!
Guest

bpf;d

By: a guest on Mar 4th, 2012  |  syntax: D  |  size: 34.86 KB  |  views: 80  |  expires: Never
download  |  raw  |  embed  |  report abuse  |  print
Text below is selected. Please press Ctrl+C to copy to your clipboard. (⌘+C on Mac)
  1. /* Converted to D from bpf.h by htod */
  2.  
  3. /*-
  4.  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
  5.  *      The Regents of the University of California.  All rights reserved.
  6.  *
  7.  * This code is derived from the Stanford/CMU enet packet filter,
  8.  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
  9.  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
  10.  * Berkeley Laboratory.
  11.  *
  12.  * Redistribution and use in source and binary forms, with or without
  13.  * modification, are permitted provided that the following conditions
  14.  * are met:
  15.  * 1. Redistributions of source code must retain the above copyright
  16.  *    notice, this list of conditions and the following disclaimer.
  17.  * 2. Redistributions in binary form must reproduce the above copyright
  18.  *    notice, this list of conditions and the following disclaimer in the
  19.  *    documentation and/or other materials provided with the distribution.
  20.  * 3. All advertising materials mentioning features or use of this software
  21.  *    must display the following acknowledgement:
  22.  *      This product includes software developed by the University of
  23.  *      California, Berkeley and its contributors.
  24.  * 4. Neither the name of the University nor the names of its contributors
  25.  *    may be used to endorse or promote products derived from this software
  26.  *    without specific prior written permission.
  27.  *
  28.  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  29.  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  30.  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  31.  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  32.  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  33.  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  34.  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  35.  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  36.  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  37.  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  38.  * SUCH DAMAGE.
  39.  *
  40.  *      @(#)bpf.h       7.1 (Berkeley) 5/7/91
  41.  *
  42.  * @(#) $Header: /tcpdump/master/libpcap/pcap/bpf.h,v 1.19.2.8 2008-09-22 20:16:01 guy Exp $ (LBL)
  43.  */
  44.  
  45. /*
  46.  * This is libpcap's cut-down version of bpf.h; it includes only
  47.  * the stuff needed for the code generator and the userland BPF
  48.  * interpreter, and the libpcap APIs for setting filters, etc..
  49.  *
  50.  * "pcap-bpf.c" will include the native OS version, as it deals with
  51.  * the OS's BPF implementation.
  52.  *
  53.  * XXX - should this all just be moved to "pcap.h"?
  54.  */
  55.  
  56. extern (C){
  57. /* BSD style release date */
  58. const BPF_RELEASE = 199606;
  59.  
  60. alias   u_int bpf_u_int32;
  61. alias int bpf_int32;
  62. alias uint u_int;
  63.  
  64. /*
  65.  * Alignment macros.  BPF_WORDALIGN rounds up to the next
  66.  * even multiple of BPF_ALIGNMENT.
  67.  */
  68. //C     #ifndef __NetBSD__
  69. //C     #define BPF_ALIGNMENT sizeof(bpf_int32)
  70. //C     #else
  71. //C     #define BPF_ALIGNMENT sizeof(long)
  72. //C     #endif
  73. //C     #define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
  74.  
  75. const BPF_MAXBUFSIZE = 0x8000;
  76.  
  77. const BPF_MINBUFSIZE = 32;
  78. /*
  79.  * Structure for "pcap_compile()", "pcap_setfilter()", etc..
  80.  */
  81. struct bpf_program
  82. {
  83.     u_int bf_len;
  84.     bpf_insn *bf_insns;
  85. }
  86.  
  87. /*
  88.  * Struct return by BIOCVERSION.  This represents the version number of
  89.  * the filter language described by the instruction encodings below.
  90.  * bpf understands a program iff kernel_major == filter_major &&
  91.  * kernel_minor >= filter_minor, that is, if the value returned by the
  92.  * running kernel has the same major number and a minor number equal
  93.  * equal to or less than the filter being downloaded.  Otherwise, the
  94.  * results are undefined, meaning an error may be returned or packets
  95.  * may be accepted haphazardly.
  96.  * It has nothing to do with the source code version.
  97.  */
  98.  
  99. const BPF_MAJOR_VERSION = 1;
  100.  
  101. const BPF_MINOR_VERSION = 1;
  102. /*
  103.  * Data-link level type codes.
  104.  *
  105.  * Do *NOT* add new values to this list without asking
  106.  * "tcpdump-workers@lists.tcpdump.org" for a value.  Otherwise, you run
  107.  * the risk of using a value that's already being used for some other
  108.  * purpose, and of having tools that read libpcap-format captures not
  109.  * being able to handle captures with your new DLT_ value, with no hope
  110.  * that they will ever be changed to do so (as that would destroy their
  111.  * ability to read captures using that value for that other purpose).
  112.  */
  113.  
  114. /*
  115.  * These are the types that are the same on all platforms, and that
  116.  * have been defined by <net/bpf.h> for ages.
  117.  */
  118. //C     #define DLT_NULL        0       /* BSD loopback encapsulation */
  119. //C     #define DLT_EN10MB      1       /* Ethernet (10Mb) */
  120. const DLT_NULL = 0;
  121. //C     #define DLT_EN3MB       2       /* Experimental Ethernet (3Mb) */
  122. const DLT_EN10MB = 1;
  123. //C     #define DLT_AX25        3       /* Amateur Radio AX.25 */
  124. const DLT_EN3MB = 2;
  125. //C     #define DLT_PRONET      4       /* Proteon ProNET Token Ring */
  126. const DLT_AX25 = 3;
  127. //C     #define DLT_CHAOS       5       /* Chaos */
  128. const DLT_PRONET = 4;
  129. //C     #define DLT_IEEE802     6       /* 802.5 Token Ring */
  130. const DLT_CHAOS = 5;
  131. //C     #define DLT_ARCNET      7       /* ARCNET, with BSD-style header */
  132. const DLT_IEEE802 = 6;
  133. //C     #define DLT_SLIP        8       /* Serial Line IP */
  134. const DLT_ARCNET = 7;
  135. //C     #define DLT_PPP         9       /* Point-to-point Protocol */
  136. const DLT_SLIP = 8;
  137. //C     #define DLT_FDDI        10      /* FDDI */
  138. const DLT_PPP = 9;
  139.  
  140. const DLT_FDDI = 10;
  141. /*
  142.  * These are types that are different on some platforms, and that
  143.  * have been defined by <net/bpf.h> for ages.  We use #ifdefs to
  144.  * detect the BSDs that define them differently from the traditional
  145.  * libpcap <net/bpf.h>
  146.  *
  147.  * XXX - DLT_ATM_RFC1483 is 13 in BSD/OS, and DLT_RAW is 14 in BSD/OS,
  148.  * but I don't know what the right #define is for BSD/OS.
  149.  */
  150.  const DLT_ATM_RFC1483 = 11;
  151. //C     #ifdef __OpenBSD__
  152. //C     #define DLT_RAW         14      /* raw IP */
  153. //C     #else
  154. //C     #define DLT_RAW         12      /* raw IP */
  155. //C     #endif
  156. const DLT_RAW = 12;
  157.  
  158. /*
  159.  * Given that the only OS that currently generates BSD/OS SLIP or PPP
  160.  * is, well, BSD/OS, arguably everybody should have chosen its values
  161.  * for DLT_SLIP_BSDOS and DLT_PPP_BSDOS, which are 15 and 16, but they
  162.  * didn't.  So it goes.
  163.  */
  164. //C     #if defined(__NetBSD__) || defined(__FreeBSD__)
  165. //C     #ifndef DLT_SLIP_BSDOS
  166. //C     #define DLT_SLIP_BSDOS  13      /* BSD/OS Serial Line IP */
  167. //C     #define DLT_PPP_BSDOS   14      /* BSD/OS Point-to-point Protocol */
  168. //C     #endif
  169. //C     #else
  170. //C     #define DLT_SLIP_BSDOS  15      /* BSD/OS Serial Line IP */
  171. //C     #define DLT_PPP_BSDOS   16      /* BSD/OS Point-to-point Protocol */
  172. const DLT_SLIP_BSDOS = 15;
  173. //C     #endif
  174. const DLT_PPP_BSDOS = 16;
  175.  
  176. /*
  177.  * 17 is used for DLT_OLD_PFLOG in OpenBSD;
  178.  *     OBSOLETE: DLT_PFLOG is 117 in OpenBSD now as well. See below.
  179.  * 18 is used for DLT_PFSYNC in OpenBSD; don't use it for anything else.
  180.  */
  181.  
  182. //C     #define DLT_ATM_CLIP    19      /* Linux Classical-IP over ATM */
  183.  
  184. const DLT_ATM_CLIP = 19;
  185. /*
  186.  * Apparently Redback uses this for its SmartEdge 400/800.  I hope
  187.  * nobody else decided to use it, too.
  188.  */
  189. const DLT_REDBACK_SMARTEDGE = 32;
  190. /*
  191.  * These values are defined by NetBSD; other platforms should refrain from
  192.  * using them for other purposes, so that NetBSD savefiles with link
  193.  * types of 50 or 51 can be read as this type on all platforms.
  194.  */
  195. //C     #define DLT_PPP_SERIAL  50      /* PPP over serial with HDLC encapsulation */
  196. //C     #define DLT_PPP_ETHER   51      /* PPP over Ethernet */
  197. const DLT_PPP_SERIAL = 50;
  198.  
  199. const DLT_PPP_ETHER = 51;
  200. /*
  201.  * The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses
  202.  * a link-layer type of 99 for the tcpdump it supplies.  The link-layer
  203.  * header has 6 bytes of unknown data, something that appears to be an
  204.  * Ethernet type, and 36 bytes that appear to be 0 in at least one capture
  205.  * I've seen.
  206.  */
  207. //C     #define DLT_SYMANTEC_FIREWALL   99
  208.  
  209. const DLT_SYMANTEC_FIREWALL = 99;
  210. /*
  211.  * Values between 100 and 103 are used in capture file headers as
  212.  * link-layer types corresponding to DLT_ types that differ
  213.  * between platforms; don't use those values for new DLT_ new types.
  214.  */
  215.  
  216. /*
  217.  * This value was defined by libpcap 0.5; platforms that have defined
  218.  * it with a different value should define it here with that value -
  219.  * a link type of 104 in a save file will be mapped to DLT_C_HDLC,
  220.  * whatever value that happens to be, so programs will correctly
  221.  * handle files with that link type regardless of the value of
  222.  * DLT_C_HDLC.
  223.  *
  224.  * The name DLT_C_HDLC was used by BSD/OS; we use that name for source
  225.  * compatibility with programs written for BSD/OS.
  226.  *
  227.  * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
  228.  * for source compatibility with programs written for libpcap 0.5.
  229.  */
  230. //C     #define DLT_C_HDLC      104     /* Cisco HDLC */
  231. //C     #define DLT_CHDLC       DLT_C_HDLC
  232. const DLT_C_HDLC = 104;
  233.  
  234. alias DLT_C_HDLC DLT_CHDLC;
  235. //C     #define DLT_IEEE802_11  105     /* IEEE 802.11 wireless */
  236.  
  237. const DLT_IEEE802_11 = 105;
  238. /*
  239.  * 106 is reserved for Linux Classical IP over ATM; it's like DLT_RAW,
  240.  * except when it isn't.  (I.e., sometimes it's just raw IP, and
  241.  * sometimes it isn't.)  We currently handle it as DLT_LINUX_SLL,
  242.  * so that we don't have to worry about the link-layer header.)
  243.  */
  244.  
  245. /*
  246.  * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides
  247.  * with other values.
  248.  * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header
  249.  * (DLCI, etc.).
  250.  */
  251. //C     #define DLT_FRELAY      107
  252.  
  253. const DLT_FRELAY = 107;
  254. /*
  255.  * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
  256.  * that the AF_ type in the link-layer header is in network byte order.
  257.  *
  258.  * DLT_LOOP is 12 in OpenBSD, but that's DLT_RAW in other OSes, so
  259.  * we don't use 12 for it in OSes other than OpenBSD.
  260.  */
  261. //C     #ifdef __OpenBSD__
  262. //C     #define DLT_LOOP        12
  263. //C     #else
  264. //C     #define DLT_LOOP        108
  265. //C     #endif
  266. const DLT_LOOP = 108;
  267.  
  268. /*
  269.  * Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's
  270.  * DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other
  271.  * than OpenBSD.
  272.  */
  273. //C     #ifdef __OpenBSD__
  274. //C     #define DLT_ENC         13
  275. //C     #else
  276. //C     #define DLT_ENC         109
  277. //C     #endif
  278. const DLT_ENC = 109;
  279.  
  280. /*
  281.  * Values between 110 and 112 are reserved for use in capture file headers
  282.  * as link-layer types corresponding to DLT_ types that might differ
  283.  * between platforms; don't use those values for new DLT_ types
  284.  * other than the corresponding DLT_ types.
  285.  */
  286.  
  287. /*
  288.  * This is for Linux cooked sockets.
  289.  */
  290. //C     #define DLT_LINUX_SLL   113
  291.  
  292. const DLT_LINUX_SLL = 113;
  293. /*
  294.  * Apple LocalTalk hardware.
  295.  */
  296. //C     #define DLT_LTALK       114
  297.  
  298. const DLT_LTALK = 114;
  299. /*
  300.  * Acorn Econet.
  301.  */
  302. //C     #define DLT_ECONET      115
  303.  
  304. const DLT_ECONET = 115;
  305. /*
  306.  * Reserved for use with OpenBSD ipfilter.
  307.  */
  308. //C     #define DLT_IPFILTER    116
  309.  
  310. const DLT_IPFILTER = 116;
  311. /*
  312.  * OpenBSD DLT_PFLOG; DLT_PFLOG is 17 in OpenBSD, but that's DLT_LANE8023
  313.  * in SuSE 6.3, so we can't use 17 for it in capture-file headers.
  314.  *
  315.  * XXX: is there a conflict with DLT_PFSYNC 18 as well?
  316.  */
  317. //C     #ifdef __OpenBSD__
  318. //C     #define DLT_OLD_PFLOG   17
  319. //C     #define DLT_PFSYNC      18
  320. //C     #endif
  321. //C     #define DLT_PFLOG       117
  322.  
  323. const DLT_PFLOG = 117;
  324. /*
  325.  * Registered for Cisco-internal use.
  326.  */
  327. //C     #define DLT_CISCO_IOS   118
  328.  
  329. const DLT_CISCO_IOS = 118;
  330. /*
  331.  * For 802.11 cards using the Prism II chips, with a link-layer
  332.  * header including Prism monitor mode information plus an 802.11
  333.  * header.
  334.  */
  335. //C     #define DLT_PRISM_HEADER        119
  336.  
  337. const DLT_PRISM_HEADER = 119;
  338. /*
  339.  * Reserved for Aironet 802.11 cards, with an Aironet link-layer header
  340.  * (see Doug Ambrisko's FreeBSD patches).
  341.  */
  342. //C     #define DLT_AIRONET_HEADER      120
  343.  
  344. const DLT_AIRONET_HEADER = 120;
  345. /*
  346.  * Reserved for Siemens HiPath HDLC.
  347.  */
  348. //C     #define DLT_HHDLC               121
  349.  
  350. const DLT_HHDLC = 121;
  351. /*
  352.  * This is for RFC 2625 IP-over-Fibre Channel.
  353.  *
  354.  * This is not for use with raw Fibre Channel, where the link-layer
  355.  * header starts with a Fibre Channel frame header; it's for IP-over-FC,
  356.  * where the link-layer header starts with an RFC 2625 Network_Header
  357.  * field.
  358.  */
  359. //C     #define DLT_IP_OVER_FC          122
  360.  
  361. const DLT_IP_OVER_FC = 122;
  362. /*
  363.  * This is for Full Frontal ATM on Solaris with SunATM, with a
  364.  * pseudo-header followed by an AALn PDU.
  365.  *
  366.  * There may be other forms of Full Frontal ATM on other OSes,
  367.  * with different pseudo-headers.
  368.  *
  369.  * If ATM software returns a pseudo-header with VPI/VCI information
  370.  * (and, ideally, packet type information, e.g. signalling, ILMI,
  371.  * LANE, LLC-multiplexed traffic, etc.), it should not use
  372.  * DLT_ATM_RFC1483, but should get a new DLT_ value, so tcpdump
  373.  * and the like don't have to infer the presence or absence of a
  374.  * pseudo-header and the form of the pseudo-header.
  375.  */
  376. //C     #define DLT_SUNATM              123     /* Solaris+SunATM */
  377.  
  378. const DLT_SUNATM = 123;
  379. /*
  380.  * Reserved as per request from Kent Dahlgren <kent@praesum.com>
  381.  * for private use.
  382.  */
  383. //C     #define DLT_RIO                 124     /* RapidIO */
  384. //C     #define DLT_PCI_EXP             125     /* PCI Express */
  385. const DLT_RIO = 124;
  386. //C     #define DLT_AURORA              126     /* Xilinx Aurora link layer */
  387. const DLT_PCI_EXP = 125;
  388.  
  389. const DLT_AURORA = 126;
  390. /*
  391.  * Header for 802.11 plus a number of bits of link-layer information
  392.  * including radio information, used by some recent BSD drivers as
  393.  * well as the madwifi Atheros driver for Linux.
  394.  */
  395. //C     #define DLT_IEEE802_11_RADIO    127     /* 802.11 plus radiotap radio header */
  396.  
  397. const DLT_IEEE802_11_RADIO = 127;
  398. /*
  399.  * Reserved for the TZSP encapsulation, as per request from
  400.  * Chris Waters <chris.waters@networkchemistry.com>
  401.  * TZSP is a generic encapsulation for any other link type,
  402.  * which includes a means to include meta-information
  403.  * with the packet, e.g. signal strength and channel
  404.  * for 802.11 packets.
  405.  */
  406. //C     #define DLT_TZSP                128     /* Tazmen Sniffer Protocol */
  407.  
  408. const DLT_TZSP = 128;
  409. /*
  410.  * BSD's ARCNET headers have the source host, destination host,
  411.  * and type at the beginning of the packet; that's what's handed
  412.  * up to userland via BPF.
  413.  *
  414.  * Linux's ARCNET headers, however, have a 2-byte offset field
  415.  * between the host IDs and the type; that's what's handed up
  416.  * to userland via PF_PACKET sockets.
  417.  *
  418.  * We therefore have to have separate DLT_ values for them.
  419.  */
  420. //C     #define DLT_ARCNET_LINUX        129     /* ARCNET */
  421.  
  422. const DLT_ARCNET_LINUX = 129;
  423. /*
  424.  * Juniper-private data link types, as per request from
  425.  * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
  426.  * for passing on chassis-internal metainformation such as
  427.  * QOS profiles, etc..
  428.  */
  429. //C     #define DLT_JUNIPER_MLPPP       130
  430. //C     #define DLT_JUNIPER_MLFR        131
  431. const DLT_JUNIPER_MLPPP = 130;
  432. //C     #define DLT_JUNIPER_ES          132
  433. const DLT_JUNIPER_MLFR = 131;
  434. //C     #define DLT_JUNIPER_GGSN        133
  435. const DLT_JUNIPER_ES = 132;
  436. //C     #define DLT_JUNIPER_MFR         134
  437. const DLT_JUNIPER_GGSN = 133;
  438. //C     #define DLT_JUNIPER_ATM2        135
  439. const DLT_JUNIPER_MFR = 134;
  440. //C     #define DLT_JUNIPER_SERVICES    136
  441. const DLT_JUNIPER_ATM2 = 135;
  442. //C     #define DLT_JUNIPER_ATM1        137
  443. const DLT_JUNIPER_SERVICES = 136;
  444.  
  445. const DLT_JUNIPER_ATM1 = 137;
  446. /*
  447.  * Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund
  448.  * <dieter@apple.com>.  The header that's presented is an Ethernet-like
  449.  * header:
  450.  *
  451.  *      #define FIREWIRE_EUI64_LEN      8
  452.  *      struct firewire_header {
  453.  *              ubyte  firewire_dhost[FIREWIRE_EUI64_LEN];
  454.  *              ubyte  firewire_shost[FIREWIRE_EUI64_LEN];
  455.  *              ushort firewire_type;
  456.  *      };
  457.  *
  458.  * with "firewire_type" being an Ethernet type value, rather than,
  459.  * for example, raw GASP frames being handed up.
  460.  */
  461. //C     #define DLT_APPLE_IP_OVER_IEEE1394      138
  462.  
  463. const DLT_APPLE_IP_OVER_IEEE1394 = 138;
  464. /*
  465.  * Various SS7 encapsulations, as per a request from Jeff Morriss
  466.  * <jeff.morriss[AT]ulticom.com> and subsequent discussions.
  467.  */
  468. //C     #define DLT_MTP2_WITH_PHDR      139     /* pseudo-header with various info, followed by MTP2 */
  469. //C     #define DLT_MTP2                140     /* MTP2, without pseudo-header */
  470. const DLT_MTP2_WITH_PHDR = 139;
  471. //C     #define DLT_MTP3                141     /* MTP3, without pseudo-header or MTP2 */
  472. const DLT_MTP2 = 140;
  473. //C     #define DLT_SCCP                142     /* SCCP, without pseudo-header or MTP2 or MTP3 */
  474. const DLT_MTP3 = 141;
  475.  
  476. const DLT_SCCP = 142;
  477. /*
  478.  * DOCSIS MAC frames.
  479.  */
  480. //C     #define DLT_DOCSIS              143
  481.  
  482. const DLT_DOCSIS = 143;
  483. /*
  484.  * Linux-IrDA packets. Protocol defined at http://www.irda.org.
  485.  * Those packets include IrLAP headers and above (IrLMP...), but
  486.  * don't include Phy framing (SOF/EOF/CRC & byte stuffing), because Phy
  487.  * framing can be handled by the hardware and depend on the bitrate.
  488.  * This is exactly the format you would get capturing on a Linux-IrDA
  489.  * interface (irdaX), but not on a raw serial port.
  490.  * Note the capture is done in "Linux-cooked" mode, so each packet include
  491.  * a fake packet header (struct sll_header). This is because IrDA packet
  492.  * decoding is dependant on the direction of the packet (incomming or
  493.  * outgoing).
  494.  * When/if other platform implement IrDA capture, we may revisit the
  495.  * issue and define a real DLT_IRDA...
  496.  * Jean II
  497.  */
  498. //C     #define DLT_LINUX_IRDA          144
  499.  
  500. const DLT_LINUX_IRDA = 144;
  501. /*
  502.  * Reserved for IBM SP switch and IBM Next Federation switch.
  503.  */
  504. //C     #define DLT_IBM_SP              145
  505. //C     #define DLT_IBM_SN              146
  506. const DLT_IBM_SP = 145;
  507.  
  508. const DLT_IBM_SN = 146;
  509. /*
  510.  * Reserved for private use.  If you have some link-layer header type
  511.  * that you want to use within your organization, with the capture files
  512.  * using that link-layer header type not ever be sent outside your
  513.  * organization, you can use these values.
  514.  *
  515.  * No libpcap release will use these for any purpose, nor will any
  516.  * tcpdump release use them, either.
  517.  *
  518.  * Do *NOT* use these in capture files that you expect anybody not using
  519.  * your private versions of capture-file-reading tools to read; in
  520.  * particular, do *NOT* use them in products, otherwise you may find that
  521.  * people won't be able to use tcpdump, or snort, or Ethereal, or... to
  522.  * read capture files from your firewall/intrusion detection/traffic
  523.  * monitoring/etc. appliance, or whatever product uses that DLT_ value,
  524.  * and you may also find that the developers of those applications will
  525.  * not accept patches to let them read those files.
  526.  *
  527.  * Also, do not use them if somebody might send you a capture using them
  528.  * for *their* private type and tools using them for *your* private type
  529.  * would have to read them.
  530.  *
  531.  * Instead, ask "tcpdump-workers@lists.tcpdump.org" for a new DLT_ value,
  532.  * as per the comment above, and use the type you're given.
  533.  */
  534. //C     #define DLT_USER0               147
  535. //C     #define DLT_USER1               148
  536. const DLT_USER0 = 147;
  537. //C     #define DLT_USER2               149
  538. const DLT_USER1 = 148;
  539. //C     #define DLT_USER3               150
  540. const DLT_USER2 = 149;
  541. //C     #define DLT_USER4               151
  542. const DLT_USER3 = 150;
  543. //C     #define DLT_USER5               152
  544. const DLT_USER4 = 151;
  545. //C     #define DLT_USER6               153
  546. const DLT_USER5 = 152;
  547. //C     #define DLT_USER7               154
  548. const DLT_USER6 = 153;
  549. //C     #define DLT_USER8               155
  550. const DLT_USER7 = 154;
  551. //C     #define DLT_USER9               156
  552. const DLT_USER8 = 155;
  553. //C     #define DLT_USER10              157
  554. const DLT_USER9 = 156;
  555. //C     #define DLT_USER11              158
  556. const DLT_USER10 = 157;
  557. //C     #define DLT_USER12              159
  558. const DLT_USER11 = 158;
  559. //C     #define DLT_USER13              160
  560. const DLT_USER12 = 159;
  561. //C     #define DLT_USER14              161
  562. const DLT_USER13 = 160;
  563. //C     #define DLT_USER15              162
  564. const DLT_USER14 = 161;
  565.  
  566. const DLT_USER15 = 162;
  567. /*
  568.  * For future use with 802.11 captures - defined by AbsoluteValue
  569.  * Systems to store a number of bits of link-layer information
  570.  * including radio information:
  571.  *
  572.  *      http://www.shaftnet.org/~pizza/software/capturefrm.txt
  573.  *
  574.  * but it might be used by some non-AVS drivers now or in the
  575.  * future.
  576.  */
  577. //C     #define DLT_IEEE802_11_RADIO_AVS 163    /* 802.11 plus AVS radio header */
  578.  
  579. const DLT_IEEE802_11_RADIO_AVS = 163;
  580. /*
  581.  * Juniper-private data link type, as per request from
  582.  * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
  583.  * for passing on chassis-internal metainformation such as
  584.  * QOS profiles, etc..
  585.  */
  586. //C     #define DLT_JUNIPER_MONITOR     164
  587.  
  588. const DLT_JUNIPER_MONITOR = 164;
  589. /*
  590.  * Reserved for BACnet MS/TP.
  591.  */
  592. //C     #define DLT_BACNET_MS_TP        165
  593.  
  594. const DLT_BACNET_MS_TP = 165;
  595. /*
  596.  * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>.
  597.  *
  598.  * This is used in some OSes to allow a kernel socket filter to distinguish
  599.  * between incoming and outgoing packets, on a socket intended to
  600.  * supply pppd with outgoing packets so it can do dial-on-demand and
  601.  * hangup-on-lack-of-demand; incoming packets are filtered out so they
  602.  * don't cause pppd to hold the connection up (you don't want random
  603.  * input packets such as port scans, packets from old lost connections,
  604.  * etc. to force the connection to stay up).
  605.  *
  606.  * The first byte of the PPP header (0xff03) is modified to accomodate
  607.  * the direction - 0x00 = IN, 0x01 = OUT.
  608.  */
  609. //C     #define DLT_PPP_PPPD            166
  610.  
  611. const DLT_PPP_PPPD = 166;
  612. /*
  613.  * Names for backwards compatibility with older versions of some PPP
  614.  * software; new software should use DLT_PPP_PPPD.
  615.  */
  616. //C     #define DLT_PPP_WITH_DIRECTION  DLT_PPP_PPPD
  617. //C     #define DLT_LINUX_PPP_WITHDIRECTION     DLT_PPP_PPPD
  618. alias DLT_PPP_PPPD DLT_PPP_WITH_DIRECTION;
  619.  
  620. alias DLT_PPP_PPPD DLT_LINUX_PPP_WITHDIRECTION;
  621. /*
  622.  * Juniper-private data link type, as per request from
  623.  * Hannes Gredler <hannes@juniper.net>.  The DLT_s are used
  624.  * for passing on chassis-internal metainformation such as
  625.  * QOS profiles, cookies, etc..
  626.  */
  627. //C     #define DLT_JUNIPER_PPPOE       167
  628. //C     #define DLT_JUNIPER_PPPOE_ATM   168
  629. const DLT_JUNIPER_PPPOE = 167;
  630.  
  631. const DLT_JUNIPER_PPPOE_ATM = 168;
  632. //C     #define DLT_GPRS_LLC            169     /* GPRS LLC */
  633. //C     #define DLT_GPF_T               170     /* GPF-T (ITU-T G.7041/Y.1303) */
  634. const DLT_GPRS_LLC = 169;
  635. //C     #define DLT_GPF_F               171     /* GPF-F (ITU-T G.7041/Y.1303) */
  636. const DLT_GPF_T = 170;
  637.  
  638. const DLT_GPF_F = 171;
  639. /*
  640.  * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line
  641.  * monitoring equipment.
  642.  */
  643. //C     #define DLT_GCOM_T1E1           172
  644. //C     #define DLT_GCOM_SERIAL         173
  645. const DLT_GCOM_T1E1 = 172;
  646.  
  647. const DLT_GCOM_SERIAL = 173;
  648. /*
  649.  * Juniper-private data link type, as per request from
  650.  * Hannes Gredler <hannes@juniper.net>.  The DLT_ is used
  651.  * for internal communication to Physical Interface Cards (PIC)
  652.  */
  653. //C     #define DLT_JUNIPER_PIC_PEER    174
  654.  
  655. const DLT_JUNIPER_PIC_PEER = 174;
  656. /*
  657.  * Link types requested by Gregor Maier <gregor@endace.com> of Endace
  658.  * Measurement Systems.  They add an ERF header (see
  659.  * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of
  660.  * the link-layer header.
  661.  */
  662. //C     #define DLT_ERF_ETH             175     /* Ethernet */
  663. //C     #define DLT_ERF_POS             176     /* Packet-over-SONET */
  664. const DLT_ERF_ETH = 175;
  665.  
  666. const DLT_ERF_POS = 176;
  667. /*
  668.  * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD
  669.  * for vISDN (http://www.orlandi.com/visdn/).  Its link-layer header
  670.  * includes additional information before the LAPD header, so it's
  671.  * not necessarily a generic LAPD header.
  672.  */
  673. //C     #define DLT_LINUX_LAPD          177
  674.  
  675. const DLT_LINUX_LAPD = 177;
  676. /*
  677.  * Juniper-private data link type, as per request from
  678.  * Hannes Gredler <hannes@juniper.net>.
  679.  * The DLT_ are used for prepending meta-information
  680.  * like interface index, interface name
  681.  * before standard Ethernet, PPP, Frelay & C-HDLC Frames
  682.  */
  683. //C     #define DLT_JUNIPER_ETHER       178
  684. //C     #define DLT_JUNIPER_PPP         179
  685. const DLT_JUNIPER_ETHER = 178;
  686. //C     #define DLT_JUNIPER_FRELAY      180
  687. const DLT_JUNIPER_PPP = 179;
  688. //C     #define DLT_JUNIPER_CHDLC       181
  689. const DLT_JUNIPER_FRELAY = 180;
  690.  
  691. const DLT_JUNIPER_CHDLC = 181;
  692. /*
  693.  * Multi Link Frame Relay (FRF.16)
  694.  */
  695. //C     #define DLT_MFR                 182
  696.  
  697. const DLT_MFR = 182;
  698. /*
  699.  * Juniper-private data link type, as per request from
  700.  * Hannes Gredler <hannes@juniper.net>.
  701.  * The DLT_ is used for internal communication with a
  702.  * voice Adapter Card (PIC)
  703.  */
  704. //C     #define DLT_JUNIPER_VP          183
  705.  
  706. const DLT_JUNIPER_VP = 183;
  707. /*
  708.  * Arinc 429 frames.
  709.  * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
  710.  * Every frame contains a 32bit A429 label.
  711.  * More documentation on Arinc 429 can be found at
  712.  * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
  713.  */
  714. //C     #define DLT_A429                184
  715.  
  716. const DLT_A429 = 184;
  717. /*
  718.  * Arinc 653 Interpartition Communication messages.
  719.  * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
  720.  * Please refer to the A653-1 standard for more information.
  721.  */
  722. //C     #define DLT_A653_ICM            185
  723.  
  724. const DLT_A653_ICM = 185;
  725. /*
  726.  * USB packets, beginning with a USB setup header; requested by
  727.  * Paolo Abeni <paolo.abeni@email.it>.
  728.  */
  729. //C     #define DLT_USB                 186
  730.  
  731. const DLT_USB = 186;
  732. /*
  733.  * Bluetooth HCI UART transport layer (part H:4); requested by
  734.  * Paolo Abeni.
  735.  */
  736. //C     #define DLT_BLUETOOTH_HCI_H4    187
  737.  
  738. const DLT_BLUETOOTH_HCI_H4 = 187;
  739. /*
  740.  * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
  741.  * <cruz_petagay@bah.com>.
  742.  */
  743. //C     #define DLT_IEEE802_16_MAC_CPS  188
  744.  
  745. const DLT_IEEE802_16_MAC_CPS = 188;
  746. /*
  747.  * USB packets, beginning with a Linux USB header; requested by
  748.  * Paolo Abeni <paolo.abeni@email.it>.
  749.  */
  750. //C     #define DLT_USB_LINUX           189
  751.  
  752. const DLT_USB_LINUX = 189;
  753. /*
  754.  * Controller Area Network (CAN) v. 2.0B packets.
  755.  * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
  756.  * Used to dump CAN packets coming from a CAN Vector board.
  757.  * More documentation on the CAN v2.0B frames can be found at
  758.  * http://www.can-cia.org/downloads/?269
  759.  */
  760. //C     #define DLT_CAN20B              190
  761.  
  762. const DLT_CAN20B = 190;
  763. /*
  764.  * IEEE 802.15.4, with address fields padded, as is done by Linux
  765.  * drivers; requested by Juergen Schimmer.
  766.  */
  767. //C     #define DLT_IEEE802_15_4_LINUX  191
  768.  
  769. const DLT_IEEE802_15_4_LINUX = 191;
  770. /*
  771.  * Per Packet Information encapsulated packets.
  772.  * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
  773.  */
  774. //C     #define DLT_PPI                 192
  775.  
  776. const DLT_PPI = 192;
  777. /*
  778.  * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
  779.  * requested by Charles Clancy.
  780.  */
  781. //C     #define DLT_IEEE802_16_MAC_CPS_RADIO    193
  782.  
  783. const DLT_IEEE802_16_MAC_CPS_RADIO = 193;
  784. /*
  785.  * Juniper-private data link type, as per request from
  786.  * Hannes Gredler <hannes@juniper.net>.
  787.  * The DLT_ is used for internal communication with a
  788.  * integrated service module (ISM).
  789.  */
  790. //C     #define DLT_JUNIPER_ISM         194
  791.  
  792. const DLT_JUNIPER_ISM = 194;
  793. /*
  794.  * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
  795.  * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.
  796.  */
  797. //C     #define DLT_IEEE802_15_4        195
  798.  
  799. const DLT_IEEE802_15_4 = 195;
  800. /*
  801.  * Various link-layer types, with a pseudo-header, for SITA
  802.  * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).
  803.  */
  804. //C     #define DLT_SITA                196
  805.  
  806. const DLT_SITA = 196;
  807. /*
  808.  * Various link-layer types, with a pseudo-header, for Endace DAG cards;
  809.  * encapsulates Endace ERF records.  Requested by Stephen Donnelly
  810.  * <stephen@endace.com>.
  811.  */
  812. //C     #define DLT_ERF                 197
  813.  
  814. const DLT_ERF = 197;
  815. /*
  816.  * Special header prepended to Ethernet packets when capturing from a
  817.  * u10 Networks board.  Requested by Phil Mulholland
  818.  * <phil@u10networks.com>.
  819.  */
  820. //C     #define DLT_RAIF1               198
  821.  
  822. const DLT_RAIF1 = 198;
  823. /*
  824.  * IPMB packet for IPMI, beginning with the I2C slave address, followed
  825.  * by the netFn and LUN, etc..  Requested by Chanthy Toeung
  826.  * <chanthy.toeung@ca.kontron.com>.
  827.  */
  828. //C     #define DLT_IPMB                199
  829.  
  830. const DLT_IPMB = 199;
  831. /*
  832.  * Juniper-private data link type, as per request from
  833.  * Hannes Gredler <hannes@juniper.net>.
  834.  * The DLT_ is used for capturing data on a secure tunnel interface.
  835.  */
  836. //C     #define DLT_JUNIPER_ST          200
  837.  
  838. const DLT_JUNIPER_ST = 200;
  839. /*
  840.  * Bluetooth HCI UART transport layer (part H:4), with pseudo-header
  841.  * that includes direction information; requested by Paolo Abeni.
  842.  */
  843. //C     #define DLT_BLUETOOTH_HCI_H4_WITH_PHDR  201
  844.  
  845. const DLT_BLUETOOTH_HCI_H4_WITH_PHDR = 201;
  846. /*
  847.  * AX.25 packet with a 1-byte KISS header; see
  848.  *
  849.  *      http://www.ax25.net/kiss.htm
  850.  *
  851.  * as per Richard Stearn <richard@rns-stearn.demon.co.uk>.
  852.  */
  853. //C     #define DLT_AX25_KISS           202
  854.  
  855. const DLT_AX25_KISS = 202;
  856. /*
  857.  * LAPD packets from an ISDN channel, starting with the address field,
  858.  * with no pseudo-header.
  859.  * Requested by Varuna De Silva <varunax@gmail.com>.
  860.  */
  861. //C     #define DLT_LAPD                203
  862.  
  863. const DLT_LAPD = 203;
  864. /*
  865.  * Variants of various link-layer headers, with a one-byte direction
  866.  * pseudo-header prepended - zero means "received by this host",
  867.  * non-zero (any non-zero value) means "sent by this host" - as per
  868.  * Will Barker <w.barker@zen.co.uk>.
  869.  */
  870. //C     #define DLT_PPP_WITH_DIR        204     /* PPP - don't confuse with DLT_PPP_WITH_DIRECTION */
  871. //C     #define DLT_C_HDLC_WITH_DIR     205     /* Cisco HDLC */
  872. const DLT_PPP_WITH_DIR = 204;
  873. //C     #define DLT_FRELAY_WITH_DIR     206     /* Frame Relay */
  874. const DLT_C_HDLC_WITH_DIR = 205;
  875. //C     #define DLT_LAPB_WITH_DIR       207     /* LAPB */
  876. const DLT_FRELAY_WITH_DIR = 206;
  877.  
  878. const DLT_LAPB_WITH_DIR = 207;
  879. /*
  880.  * 208 is reserved for an as-yet-unspecified proprietary link-layer
  881.  * type, as requested by Will Barker.
  882.  */
  883.  
  884. /*
  885.  * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman
  886.  * <avn@pigeonpoint.com>.
  887.  */
  888. //C     #define DLT_IPMB_LINUX          209
  889.  
  890. const DLT_IPMB_LINUX = 209;
  891. /*
  892.  * FlexRay automotive bus - http://www.flexray.com/ - as requested
  893.  * by Hannes Kaelber <hannes.kaelber@x2e.de>.
  894.  */
  895. //C     #define DLT_FLEXRAY             210
  896.  
  897. const DLT_FLEXRAY = 210;
  898. /*
  899.  * Media Oriented Systems Transport (MOST) bus for multimedia
  900.  * transport - http://www.mostcooperation.com/ - as requested
  901.  * by Hannes Kaelber <hannes.kaelber@x2e.de>.
  902.  */
  903. //C     #define DLT_MOST                211
  904.  
  905. const DLT_MOST = 211;
  906. /*
  907.  * Local Interconnect Network (LIN) bus for vehicle networks -
  908.  * http://www.lin-subbus.org/ - as requested by Hannes Kaelber
  909.  * <hannes.kaelber@x2e.de>.
  910.  */
  911. //C     #define DLT_LIN                 212
  912.  
  913. const DLT_LIN = 212;
  914. /*
  915.  * X2E-private data link type used for serial line capture,
  916.  * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
  917.  */
  918. //C     #define DLT_X2E_SERIAL          213
  919.  
  920. const DLT_X2E_SERIAL = 213;
  921. /*
  922.  * X2E-private data link type used for the Xoraya data logger
  923.  * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
  924.  */
  925. //C     #define DLT_X2E_XORAYA          214
  926.  
  927. const DLT_X2E_XORAYA = 214;
  928. /*
  929.  * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
  930.  * nothing), but with the PHY-level data for non-ASK PHYs (4 octets
  931.  * of 0 as preamble, one octet of SFD, one octet of frame length+
  932.  * reserved bit, and then the MAC-layer data, starting with the
  933.  * frame control field).
  934.  *
  935.  * Requested by Max Filippov <jcmvbkbc@gmail.com>.
  936.  */
  937. //C     #define DLT_IEEE802_15_4_NONASK_PHY     215
  938.  
  939. const DLT_IEEE802_15_4_NONASK_PHY = 215;
  940.  
  941. /*
  942.  * DLT and savefile link type values are split into a class and
  943.  * a member of that class.  A class value of 0 indicates a regular
  944.  * DLT_/LINKTYPE_ value.
  945.  */
  946. //C     #define DLT_CLASS(x)            ((x) & 0x03ff0000)
  947.  
  948. /*
  949.  * NetBSD-specific generic "raw" link type.  The class value indicates
  950.  * that this is the generic raw type, and the lower 16 bits are the
  951.  * address family we're dealing with.  Those values are NetBSD-specific;
  952.  * do not assume that they correspond to AF_ values for your operating
  953.  * system.
  954.  */
  955. //C     #define DLT_CLASS_NETBSD_RAWAF  0x02240000
  956. //C     #define DLT_NETBSD_RAWAF(af)    (DLT_CLASS_NETBSD_RAWAF | (af))
  957. const DLT_CLASS_NETBSD_RAWAF = 0x02240000;
  958. //C     #define DLT_NETBSD_RAWAF_AF(x)  ((x) & 0x0000ffff)
  959. //C     #define DLT_IS_NETBSD_RAWAF(x)  (DLT_CLASS(x) == DLT_CLASS_NETBSD_RAWAF)
  960.  
  961.  
  962. /*
  963.  * The instruction encodings.
  964.  */
  965. /* instruction classes */
  966. //C     #define BPF_CLASS(code) ((code) & 0x07)
  967. //C     #define         BPF_LD          0x00
  968. //C     #define         BPF_LDX         0x01
  969. const BPF_LD = 0x00;
  970. //C     #define         BPF_ST          0x02
  971. const BPF_LDX = 0x01;
  972. //C     #define         BPF_STX         0x03
  973. const BPF_ST = 0x02;
  974. //C     #define         BPF_ALU         0x04
  975. const BPF_STX = 0x03;
  976. //C     #define         BPF_JMP         0x05
  977. const BPF_ALU = 0x04;
  978. //C     #define         BPF_RET         0x06
  979. const BPF_JMP = 0x05;
  980. //C     #define         BPF_MISC        0x07
  981. const BPF_RET = 0x06;
  982.  
  983. const BPF_MISC = 0x07;
  984. /* ld/ldx fields */
  985. //C     #define BPF_SIZE(code)  ((code) & 0x18)
  986. //C     #define         BPF_W           0x00
  987. //C     #define         BPF_H           0x08
  988. const BPF_W = 0x00;
  989. //C     #define         BPF_B           0x10
  990. const BPF_H = 0x08;
  991. //C     #define BPF_MODE(code)  ((code) & 0xe0)
  992. const BPF_B = 0x10;
  993. //C     #define         BPF_IMM         0x00
  994. //C     #define         BPF_ABS         0x20
  995. const BPF_IMM = 0x00;
  996. //C     #define         BPF_IND         0x40
  997. const BPF_ABS = 0x20;
  998. //C     #define         BPF_MEM         0x60
  999. const BPF_IND = 0x40;
  1000. //C     #define         BPF_LEN         0x80
  1001. const BPF_MEM = 0x60;
  1002. //C     #define         BPF_MSH         0xa0
  1003. const BPF_LEN = 0x80;
  1004.  
  1005. const BPF_MSH = 0xa0;
  1006. /* alu/jmp fields */
  1007. //C     #define BPF_OP(code)    ((code) & 0xf0)
  1008. //C     #define         BPF_ADD         0x00
  1009. //C     #define         BPF_SUB         0x10
  1010. const BPF_ADD = 0x00;
  1011. //C     #define         BPF_MUL         0x20
  1012. const BPF_SUB = 0x10;
  1013. //C     #define         BPF_DIV         0x30
  1014. const BPF_MUL = 0x20;
  1015. //C     #define         BPF_OR          0x40
  1016. const BPF_DIV = 0x30;
  1017. //C     #define         BPF_AND         0x50
  1018. const BPF_OR = 0x40;
  1019. //C     #define         BPF_LSH         0x60
  1020. const BPF_AND = 0x50;
  1021. //C     #define         BPF_RSH         0x70
  1022. const BPF_LSH = 0x60;
  1023. //C     #define         BPF_NEG         0x80
  1024. const BPF_RSH = 0x70;
  1025. //C     #define         BPF_JA          0x00
  1026. const BPF_NEG = 0x80;
  1027. //C     #define         BPF_JEQ         0x10
  1028. const BPF_JA = 0x00;
  1029. //C     #define         BPF_JGT         0x20
  1030. const BPF_JEQ = 0x10;
  1031. //C     #define         BPF_JGE         0x30
  1032. const BPF_JGT = 0x20;
  1033. //C     #define         BPF_JSET        0x40
  1034. const BPF_JGE = 0x30;
  1035. //C     #define BPF_SRC(code)   ((code) & 0x08)
  1036. const BPF_JSET = 0x40;
  1037. //C     #define         BPF_K           0x00
  1038. //C     #define         BPF_X           0x08
  1039. const BPF_K = 0x00;
  1040.  
  1041. const BPF_X = 0x08;
  1042. /* ret - BPF_K and BPF_X also apply */
  1043. //C     #define BPF_RVAL(code)  ((code) & 0x18)
  1044. //C     #define         BPF_A           0x10
  1045.  
  1046. const BPF_A = 0x10;
  1047. /* misc */
  1048. //C     #define BPF_MISCOP(code) ((code) & 0xf8)
  1049. //C     #define         BPF_TAX         0x00
  1050. //C     #define         BPF_TXA         0x80
  1051. const BPF_TAX = 0x00;
  1052.  
  1053. const BPF_TXA = 0x80;
  1054. /*
  1055.  * The instruction data structure.
  1056.  */
  1057. //C     struct bpf_insn {
  1058. //C             ushort  code;
  1059. //C             ubyte   jt;
  1060. struct bpf_insn {
  1061.         ushort  code;
  1062.         ubyte   jt;
  1063.         ubyte   jf;
  1064.         bpf_u_int32 k;
  1065. }
  1066.  
  1067. //#define BPF_STMT(code, k) { (ushort)(code), 0, 0, k }
  1068. //#define BPF_JUMP(code, k, jt, jf) { (ushort)(code), jt, jf, k }
  1069.  
  1070.  
  1071. extern int bpf_validate(const bpf_insn *, int);
  1072. extern u_int bpf_filter(const bpf_insn *, const ubyte *, u_int, u_int);
  1073.  
  1074.  
  1075. /*
  1076.  * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
  1077.  */
  1078. const BPF_MEMWORDS =16;
  1079. }