It's a bit more convenient for Ethereal if the "sll_protocol" field is

at the end of the link-layer header; put it there.

Put in a comment indicating that the layout of the link-layer header
shouldn't be changed; if a new header is necessary, a new DLL_ type
should be introduced for it.

1 files changed, 16 insertions, 2 deletions

diff --git a/sll.h b/sll.h
index f6c38263..541bbc53 100644
--- a/sll.h
+++ b/sll.h
@@ -35,7 +35,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * @(#) $Header: /tcpdump/master/tcpdump/sll.h,v 1.3 2000-12-22 22:45:12 guy Exp $ (LBL)
+ * @(#) $Header: /tcpdump/master/tcpdump/sll.h,v 1.4 2000-12-23 07:52:11 guy Exp $ (LBL)
  */
 
 /*
@@ -60,6 +60,20 @@
  *	specified by the previous value.
  *
  * All fields except for the link-layer address are in network byte order.
+ *
+ * DO NOT change the layout of this structure, or change any of the
+ * LINUX_SLL_ values below.  If you must change the link-layer header
+ * for a "cooked" Linux capture, introduce a new DLT_ type (ask
+ * "tcpdump-workers@tcpdump.org" for one, so that you don't give it a
+ * value that collides with a value already being used), and use the
+ * new header in captures of that type, so that programs that can
+ * handle DLT_LINUX_SLL captures will continue to handle them correctly
+ * without any change, and so that capture files with different headers
+ * can be told apart and programs that read them can dissect the
+ * packets in them.
+ *
+ * This structure, and the #defines below, must be the same in the
+ * libpcap and tcpdump versions of "sll.h".
  */
 
 /*
@@ -70,10 +84,10 @@
 
 struct sll_header {
 	u_int16_t	sll_pkttype;	/* packet type */
-	u_int16_t	sll_protocol;	/* protocol */
 	u_int16_t	sll_hatype;	/* link-layer address type */
 	u_int16_t	sll_halen;	/* link-layer address length */
 	u_int8_t	sll_addr[SLL_ADDRLEN];	/* link-layer address */
+	u_int16_t	sll_protocol;	/* protocol */
 };
 
 /*