Repository navigation
Dissectors for non-ethertype ARPHRD types on LINUX_SLL/SLL2 (NETLINK/IPGRE/IP6GRE/802.11 radiotap/FRAD) #2460
Description
Summary
Follow-up from #2443. LinuxSLL/LinuxSLL2 fall back to Raw for the five arphrd_type values whose protocol_type field isn't an EtherType (NETLINK, IPGRE, IP6GRE, IEEE80211_RADIOTAP, FRAD — see _ARPHRD_NOT_ETHERTYPE in pcapkit/protocols/link/linux_sll.py). The header is preserved, nothing crashes, but nothing is dissected either.
Scope
Five potential new dissectors, of varying rarity:
NETLINK— Linux kernel Netlink sockets, a different framing entirely from "next protocol over this link".IPGRE/IP6GRE— GRE over IPv4/IPv6; a GRE dissector doesn't exist yet in this codebase.IEEE80211_RADIOTAP— 802.11 with radiotap headers; no 802.11 dissector exists yet.FRAD— Frame Relay Access Device; niche, declining real-world capture volume.
Left as a separate follow-up (not folded into #2443/#2438's current wave) given the scope — each of these is effectively its own new-protocol implementation, not a tweak to the existing LINUX_SLL work.
Activity
JarryShaw commentedon Oct 30, 2026
Relabeling to
blocked: this extends LinuxSLL/SLL2's next-layer dispatch logic, which is still under active revision on PR #2443 (currentlyreview: runningafter two correction rounds). Starting these 5 dissectors against an unmerged, still-moving base risks rebasing the same work twice.Unblocks when #2443 merges to
main.fix(link): make LINUX_SLL family selector work, fix CI gap it caused
fix(link): make LINUX_SLL family selector work, fix CI gap it caused
fix(link): make LINUX_SLL family selector work, fix CI gap it caused
3 remaining items
JarryShaw commentedon Oct 31, 2026
Tracking/umbrella issue for the five follow-ups, now underway:
pcapkit.protocols.link.frad.FRAD.one dissector, only the
arphrd_typebinding differs)Relabelling
wip(droppingpending) since #2499 is open against the firstslice.
feat(link): add a FRAD dissector for Frame Relay over LinuxSLL (#2460)
JarryShaw commentedon Oct 31, 2026
NETLINK's dissector is up: #2507. Dissects the fixed 16-octet
nlmsghdrframing (nlmsg_len/type/flags/seq/pid); per-family message payloads and multiple messages packed into one capture frame are out of scope for this first cut and documented as such. Byte order is guessed the way Wireshark's own netlink dissector does, since Netlink has none of its own (kernel/userspace IPC, not wire format). IPGRE/IP6GRE and IEEE80211_RADIOTAP remainRaw.JarryShaw commentedon Oct 31, 2026
GRE (IPGRE/IP6GRE) dissector up in #2508. FRAD (#2499) and NETLINK (#2507) each have their own PR already; IEEE80211_RADIOTAP (#2502) remains.
JarryShaw commentedon Oct 31, 2026
Radiotap's dissector is up: #2509. Decodes the fixed 8-octet start (
it_version/it_pad/it_len) and walks the present-flags chain (including bit-31 extended-word chaining) far enough to count its words; the optional-field region those bits select is skipped whole rather than decoded field by field, and the 802.11 MAC frame behind it -- which has no dissector anywhere in this package yet -- is kept asRaw/NoPayload, same choiceNetlinkmakes for its own per-family payloads.The last of the five
arphrd_typefollow-ups to get a dissector of its own. FRAD (#2499), NETLINK (#2507) and GRE (#2508) are each still open on their own PR; none has merged yet, so this stays "Part of #2460" rather than closing it -- whichever of the four lands last should close the umbrella.feat(link): add a FRAD dissector for Frame Relay over LinuxSLL (#2460) (
feat(link): add Netlink dissector for ARPHRD_NETLINK on LINUX_SLL/SLL2 (
feat(link): add GRE dissector for IPGRE/IP6GRE on LINUX_SLL/SLL2 (#2508)
fix(link): drop LinuxSLL's dead Raw fallback, pin truncated FRAD (#2502)