Commit 046af98b authored by Felipe Contreras's avatar Felipe Contreras Committed by Mark Nauwelaerts
Browse files

pcapparse: fix SLL parsing

The current code is not checking for ethernet type, as it's supposed to,
but link layer device type and it's hard-coded to only accept dumps from
ethernet (ARPHRD_ETHER; 1). We don't care where the dump was fetched
from (wlan, 3G, etc.)

What we care about is the that the ethernet type is IP (ETHERNET_IP;
0x800), which is clearly field 14:

And do a bit of cleanup.
Signed-off-by: default avatarFelipe Contreras <>
parent 634d29cd
......@@ -367,24 +367,20 @@ gst_pcap_parse_scan_frame (GstPcapParse * self,
return FALSE;
eth_type = GUINT16_FROM_BE (*((guint16 *) (buf + 12)));
if (eth_type != 0x800)
return FALSE;
buf_ip = buf + ETH_HEADER_LEN;
case DLT_SLL:
return FALSE;
eth_type = GUINT16_FROM_BE (*((guint16 *) (buf + 2)));
if (eth_type != 1)
return FALSE;
eth_type = GUINT16_FROM_BE (*((guint16 *) (buf + 14)));
buf_ip = buf + SLL_HEADER_LEN;
if (eth_type != 0x800)
return FALSE;
b = *buf_ip;
if (((b >> 4) & 0x0f) != 4)
return FALSE;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment