Is LINKTYPE_PCI_EXP (125) intended for private use or is it the standard for all PCIe captures?

[atabou]

In the code below, it is not clear if LINKTYPE_PCI_EXP is meant to be used for PCIe captures. It is said that it is reserved for an individual.

libpcap/pcap/dlt.h

Lines 479 to 485 in ad90fea

	/*
	* Reserved as per request from Kent Dahlgren <[email protected]>
	* for private use.
	*/
	#define DLT_RIO 124 /* RapidIO */
	#define DLT_PCI_EXP 125 /* PCI Express */
	#define DLT_AURORA 126 /* Xilinx Aurora link layer */

If so, would it be possible to define a DLT and a LINKTYPE for PCIe that is meant to be used by everyone for such traffic?

[infrastation]

That would imply defining a link-level type format for PCIe. The format could depend on the hardware used for such capture, in case it delivers PCIe frames with metadata such as timestamp, bus speed, direction etc.

[guyharris]

The format could depend on the hardware used for such capture, in case it delivers PCIe frames with metadata such as timestamp, bus speed, direction etc.

If the hardware delivers a timestamp, that should be turned into the timestamp in the pcap packet record header or pcapng Extended Packet Block header. Other metadata would be included in a pseudo-header.

[guyharris]

it is not clear if LINKTYPE_PCI_EXP is meant to be used for PCIe captures.

The name, and the comment, suggest that it is.

It is said that it is reserved for an individual.

Unfortunately, I do not have a copy of any email in which Kent Dahlgren requested that LINKTYPE_ value or the other two LINKTYPE_ values; however, from his LInkedin page, he appears still to be at Praesum Communications, so I'll send him an email and see if 1) he still knows any details about how those link-layer types are supposed to work and 2) how those types encapsulated packets.

[guyharris]

OK, the email in which he requested them is at https://seclists.org/tcpdump/2002/q4/31; unfortunately, no details were provided.

[infrastation]

You are right, I forgot about the timestamp that is already there.

[guyharris]

It is said that it is reserved for an individual

It was reserved for a corporation by an individual who is the CEO and founder of that corporation.

When I asked him about this, it turns out that Praesum never used any of those LINKTYPE_ values, as using network capture files to store local bus traffic turned out to be a bit of a square peg being put into a round hole due to issues such as control symbols possibly appearing in the middle of packets in RapidIO, so he said we could reallocate those values.

If you have a proposal for a format to be used for PCIe captures, and either don't think it'll run into those issues or don't need to worry about those issues in your use case, please either submit a proposal, including the details of the format sufficient to allow an application developer to write code to parse those packets, to [email protected], or submit it as a pull request, adding a new page to give those details, to our Web site repository, for using LINKTYPE_PCI_EXP.

[atabou]

Thank you very much for the clarification. I'll submit submit the request in due time.