Mastodawn

Are there any very minimal #flex / #bison like things that will produce a self-contained parser (maybe in a single function, no libraries) for a very small #ABNF or equivalent. #libpcap has grown a slightly complex capture source definition as it moves to mainstream the #rpcap mechanism. It used to be just "eth0" or "de0", but now there are many more things. Probably a superset of URN-syntax.

T_X Jan 6, 2025

And on another good news, got some sign of life from a #tcpdump / #libpcap maintainer. Hopefully the @batadv dissector for libpcap will be merged eventually... It's been more than 4 years already with only eventual feedback from upstream... This would really help with debugging network issues, especially on #embedded devices, and capturing only the data you need with minimal performance overhead.

T_X Nov 24, 2024

Also: My pull-request for #tcpdump / #libpcap to add #batman_adv support to it is now four years old. "Happy" birthday!

...
https://github.com/the-tcpdump-group/libpcap/pull/980

Add support for B.A.T.M.A.N. Advanced by T-X · Pull Request #980 · the-tcpdump-group/libpcap

This adds support for the layer 2 mesh routing protocol B.A.T.M.A.N. Advanced. "batadv" can be used to filter on batman-adv packets. It also allows later filters to look at frames inside ...

GitHub

T_X Sep 11, 2023

Updated my patch for #tcpdump / #libpcap to add #batman_adv support. The patch is nearing 3 years of getting no full review... and I have no clue why that is.

This patch allows to filter for specific batman-adv packet types. And allows to filter within a packets payload by adjusting offsets, like "tcpdump ... 'batadv 15 bcast and arp' ". Very handy for debugging, especially on devices with limited resources, as libpcap uses #BPF on #Linux.

https://github.com/the-tcpdump-group/libpcap/pull/980

#mesh #meshnetwork #BATMAN

Add support for B.A.T.M.A.N. Advanced by T-X · Pull Request #980 · the-tcpdump-group/libpcap

This adds support for the layer 2 mesh routing protocol B.A.T.M.A.N. Advanced. "batadv" can be used to filter on batman-adv packets. It also allows later filters to look at frames inside ...

GitHub

bitkeks Dec 28, 2022

finally got around to write a PoC for a #rust-based #libpcap analysis/interceptor tool. But since https://crates.io/crates/pcap uses unsafe rust to wrap around the native libpcap library, there's no way to build the binary statically, right? The target system on which the binary shall be executed on must provide the libpcap.so?

I also used https://www.tcpdump.org/linktypes.html as reference fyi