> Input options
> -------------
> -Interface: You have to choose, which interface (network card) should be used to capture packets from. Be sure to select the correct one, as it's a common mistake to select the wrong interface.
>
> -Link-layer header type: XXX: could someone please explain this?
It's used for three different purposes:
1) At least for many 802.11 devices on FreeBSD 5.2 and later, and
in the current CVS version of NetBSD, packets can be supplied
as:
fake Ethernet packets;
packets with an 802.11 header;
packets with an 802.11 header plus additional
information such as radio information (data rate, signal
strength, noise level, etc.).
You can specify which type of header you want.
(I think this was done so that applications that know about
Ethernet headers but not 802.11 headers don't have to be
modified to know about 802.11 headers to work with 802.11
devices.)
2) For DAG devices from Endace, when capturing on a serial link,
you can specify whether the link-layer headers are PPP or
Cisco HDLC, as the device itself doesn't know.
3) Some Cisco cable modem equipment can transmit DOCSIS packets
on an Ethernet link inside an Ethernet frame; you can tell
libpcap to treat Ethernet packets for this capture as DOCSIS
packets, so that the file has a link-layer type of DOCSIS
rather than Ethernet.
Feature 1) is supported by libpcap 0.8.1 and later; features 2) and 3)
are supported only by the current CVS version of libpcap.
For 1), Ethereal should probably default to "802.11" (currently, libpcap
cannot do any significant amount of filtering on the 802.11+extra
information packets, as they have a variable-length link-layer header,
and it currently can't handle that - it's on my to-do list).
For 2), there's really no obvious default, other than "most likely"
(libpcap defaults to Cisco HDLC, but I'll have to ask the Endace people
whether it should default to PPP instead - it should probably default to
the more likely of the two link-layer types).
For 3), Ethereal should default to Ethernet, as that's by far the most
likely case.
