From 24398758e1fab5e5dcc94165edb0a837e33fa632 Mon Sep 17 00:00:00 2001
From: William Robinet <william.robinet@conostix.com>
Date: Tue, 12 Sep 2023 12:50:12 +0200
Subject: [PATCH] Set packet type for RAW PCAPs

---
 base/pcap-snoop.c.in | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/base/pcap-snoop.c.in b/base/pcap-snoop.c.in
index 6f2d75e..43a68c9 100644
--- a/base/pcap-snoop.c.in
+++ b/base/pcap-snoop.c.in
@@ -205,6 +205,18 @@ void pcap_cb(u_char *ptr, const struct pcap_pkthdr *hdr, const u_char *data) {
 
   switch(pcap_if_type) {
     case DLT_RAW:
+      switch(((u_int8_t)*data) >> 4) {
+        case 4:
+          type = ETHERTYPE_IP;
+          break;
+        case 6:
+          type = ETHERTYPE_IPV6;
+          break;
+        default:
+          fprintf(stderr, "Unknown packet type, skipping ...\n");
+          return;
+      }
+      break;
 #ifdef DLT_LOOP
     case DLT_LOOP:
 #endif