What does SLL stand for? On the Wireshark SLL wiki page, it states that,
For those who are curious, "SLL" stands for "sockaddr_ll"", but then goes on to say:
This means that information such as the link-layer protocol's packet type field, if any, isn't available, so libpcap constructs a synthetic link-layer [emphasis added] header from the address supplied when it does a recvfrom() on the socket.
In any case, if it does stand for "sockaddr_ll", is there an actual reference somewhere to corroborate that? And here, the "ll" presumably stands for "Link Layer", would that be correct?
I was thinking that "Synthetic Link-Layer", "Synthesized Link-Layer", or possibly even "Substitue[d] Link-Layer" might be more likely, but I can't find any real definition anywhere. Even in the Linux "sll.h" header file, it doesn't specifically mention it, only that it, "... is derived from the Stanford/CMU enet packet filter, (net/enet.c) distributed as part of 4.3BSD, ..."
I am interested in order to possibly update some Wireshark documentation.
asked 12 Sep '13, 12:47
I guess that's because of the definition of sockaddr_ll in the Linux kernel.
I would say yes, although there is no clear reference in the kernel code from 'll' to "Link Layer". But in the context where is defined, it makes sense.
However: In the man page of packet(7), it is referenced as "Link Level".
Link Layer or Link Level? I would vote for Link Layer, as that's a pretty common term.
Let's wait what the libpcap hackers have to say ;-))
answered 12 Sep '13, 13:52
Kurt Knochner ♦
edited 12 Sep '13, 14:07