[Feature] Add support for DLT_LINUX_SLL2

[tsaarni]

I have capture file that uses DLT_LINUX_SLL2 link layer format https://www.tcpdump.org/linktypes/LINKTYPE_LINUX_SLL2.html. It is used by default by tcpdump. When trying to run tcprewrite following error is printed since the link type LINKTYPE_LINUX_SLL2 (276) is not recognized

Fatal Error: Error initializing tcpedit: From plugins/dlt_plugins.c:tcpedit_dlt_init() line 148:
No DLT plugin available for source DLT: 0x114

It would be great to see support for DLT_LINUX_SLL2.

[fklassen]

Thanks for the PR. I do enhancement releases about once a year. Queued for 4.5 release. Do you have test PCAPs? Will have to update current tests.

[tsaarni]

In case he is not subscribed to this issue I'll Cc @btriller who kindly impemented the PR!

[tsaarni]

Attaching example capture file linux-cooked2-example.pcap.zip

[esemeniuc]

Would love to see this also!

[esemeniuc]

A workaround in the meantime is to manually set the data link type (DLT) in tcpdump using the --linktype flag, eg

sudo tcpdump -i lo dst 127.0.0.1 and dst port 9000 -X -n --linktype EN10MB -w demo.pcap

[fklassen]

Implemented in PR's #728 and #820. Will be available in v4.5.0