tcpdump

When I start up tcpdump the I get:

listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes

What does the EN10MB mean? I'm pretty sure this is a 100M ethernet card.

Dan

Dan wrote:

> When I start up tcpdump the I get:
>
> listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
>
> What does the EN10MB mean? I'm pretty sure this is a 100M ethernet card.

http://www.tcpdump.org/release/libpcap-0.9.4.tar.gz

cf. libpcap-0.9.4/pcap-bpf.h

/*
* Data-link level type codes.
*
* Do *NOT* add new values to this list without asking
* "tcpdump-(E-Mail Removed)" for a value. Otherwise, you run the
* risk of using a value that's already being used for some other purpose,
* and of having tools that read libpcap-format captures not being able
* to handle captures with your new DLT_ value, with no hope that they
* will ever be changed to do so (as that would destroy their ability
* to read captures using that value for that other purpose).
*/

/*
* These are the types that are the same on all platforms, and that
* have been defined by <net/bpf.h> for ages.
*/
#define DLT_NULL 0 /* BSD loopback encapsulation */
#define DLT_EN10MB 1 /* Ethernet (10Mb) */
#define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */
#define DLT_AX25 3 /* Amateur Radio AX.25 */
#define DLT_PRONET 4 /* Proteon ProNET Token Ring */
#define DLT_CHAOS 5 /* Chaos */
#define DLT_IEEE802 6 /* IEEE 802 Networks */
#define DLT_ARCNET 7 /* ARCNET, with BSD-style header */
#define DLT_SLIP 8 /* Serial Line IP */
#define DLT_PPP 9 /* Point-to-point Protocol */
#define DLT_FDDI 10 /* FDDI */


As far as I understand, EN10MB describes all flavors of Ethernet,
even 10 Gbit/s :-)

Regards.