{"action":"created","issue":{"url":"https://api.github.com/repos/the-tcpdump-group/libpcap/issues/127","repository_url":"https://api.github.com/repos/the-tcpdump-group/libpcap","labels_url":"https://api.github.com/repos/the-tcpdump-group/libpcap/issues/127/labels{/name}","comments_url":"https://api.github.com/repos/the-tcpdump-group/libpcap/issues/127/comments","events_url":"https://api.github.com/repos/the-tcpdump-group/libpcap/issues/127/events","html_url":"https://github.com/the-tcpdump-group/libpcap/issues/127","id":13224600,"number":127,"title":"Display/filter on packet direction and interface name","user":{"login":"guyharris","id":3599441,"avatar_url":"https://avatars.githubusercontent.com/u/3599441?v=3","gravatar_id":"","url":"https://api.github.com/users/guyharris","html_url":"https://github.com/guyharris","followers_url":"https://api.github.com/users/guyharris/followers","following_url":"https://api.github.com/users/guyharris/following{/other_user}","gists_url":"https://api.github.com/users/guyharris/gists{/gist_id}","starred_url":"https://api.github.com/users/guyharris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guyharris/subscriptions","organizations_url":"https://api.github.com/users/guyharris/orgs","repos_url":"https://api.github.com/users/guyharris/repos","events_url":"https://api.github.com/users/guyharris/events{/privacy}","received_events_url":"https://api.github.com/users/guyharris/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/the-tcpdump-group/libpcap/labels/feature%20request","name":"feature request","color":"207de5"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":17,"created_at":"2013-04-15T23:17:59Z","updated_at":"2016-07-20T10:52:06Z","closed_at":null,"body":"Converted from [SourceForge issue 2850109](http://sourceforge.net/support/tracker.php?aid=2850109), submitted by leonerd\n\nWhen capturing from a single interface, libpcap only allows the EN10MB link type, which contains only the ethernet frame, with no context such as would provide packet direction. This makes it impossible to dump a single interface and know the direction.\r\n\r\nWhen capturing from \"-i any\", libpcap on Linux provides LINUX_SLL, which seems to throw away such useful information as ifindex, making it impossible to know which of the many interfaces the packet was found on.\r\n\r\nPlease therefore provide some way to have all of this; if by no other mechanism, lets have LINUX_SLL2 which is a complete copy of the entire struct sockaddr_ll, which will therefore have the sll_pkttype (for direction) and sll_ifindex (for interface index) fields. Allow any capture on Linux, of a single interface or all, to switch to this frame type.\r\n\r\nThis would allow us to make tcpdump incantations such as the following, which right now are impossible:\r\n\r\n  # Capture packets pertaining to the locally running SSH server, ignoring any locally running SSH clients\r\n  tcpdump inbound tcp dest port 22 or outbound tcp source port 22 \r\n\r\n  # I am a firewalling bridge, capture packets flowing in one direction only, to see what is being dropped\r\n  tcpdump -i any inbound ifname \"eth0\" or outbound ifname \"eth1\"\r\n\r\nUsing this newfound information, it would then be possible for tcpdump's packet output to display it; I might suggest something like:\r\n\r\n# tcpdump -n -i eth0 icmp\r\ntcpdump: verbose output suppressed, use -v or -vv for full protocol decode\r\nlistening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes\r\n17:25:08.727472 Tx IP 192.168.2.221 > 192.168.2.1: ICMP echo request, id 62524, seq 3, length 64\r\n17:25:08.727642 Rx IP 192.168.2.1 > 192.168.2.221: ICMP echo reply, id 62524, seq 3, length 64\r\n\r\n# tcpdump -n -i any\r\ntcpdump: verbose output suppressed, use -v or -vv for full protocol decode\r\nlistening on any, link-type LINUX_SLL (Linux cooked), capture size 96 bytes\r\n17:26:42.944458 Rx(eth0) ARP, Request who-has 192.168.2.133 tell 192.168.2.135, length 46\r\n17:26:43.105021 Rx(eth0) ARP, Request who-has 192.168.0.251 tell 192.168.0.1, length 46"},"comment":{"url":"https://api.github.com/repos/the-tcpdump-group/libpcap/issues/comments/233916773","html_url":"https://github.com/the-tcpdump-group/libpcap/issues/127#issuecomment-233916773","issue_url":"https://api.github.com/repos/the-tcpdump-group/libpcap/issues/127","id":233916773,"user":{"login":"infrastation","id":900115,"avatar_url":"https://avatars.githubusercontent.com/u/900115?v=3","gravatar_id":"","url":"https://api.github.com/users/infrastation","html_url":"https://github.com/infrastation","followers_url":"https://api.github.com/users/infrastation/followers","following_url":"https://api.github.com/users/infrastation/following{/other_user}","gists_url":"https://api.github.com/users/infrastation/gists{/gist_id}","starred_url":"https://api.github.com/users/infrastation/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/infrastation/subscriptions","organizations_url":"https://api.github.com/users/infrastation/orgs","repos_url":"https://api.github.com/users/infrastation/repos","events_url":"https://api.github.com/users/infrastation/events{/privacy}","received_events_url":"https://api.github.com/users/infrastation/received_events","type":"User","site_admin":false},"created_at":"2016-07-20T10:52:06Z","updated_at":"2016-07-20T10:52:06Z","body":"The mailing list is fine. AFAIR the issue has been [discussed](http://seclists.org/tcpdump/2015/q1/16) on the list and the best solution agreed upon. It is the actual working code that is still missing."}}
{"actor":{"display_login":"infrastation"}}