From dd20142c87e99ef8b5464238ee70439e35cd5cae Mon Sep 17 00:00:00 2001
From: Oleg Smolsky <osmolsky@netskope.com>
Date: Thu, 7 Sep 2023 16:26:29 +0000
Subject: [PATCH] base: add support for "raw ip" captures

 - there is no need to deal with L2 as it's not even there
---
 base/pcap-snoop.c.in | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/base/pcap-snoop.c.in b/base/pcap-snoop.c.in
index 6f2d75e..76b9908 100644
--- a/base/pcap-snoop.c.in
+++ b/base/pcap-snoop.c.in
@@ -205,6 +205,8 @@ void pcap_cb(u_char *ptr, const struct pcap_pkthdr *hdr, const u_char *data) {
 
   switch(pcap_if_type) {
     case DLT_RAW:
+      type = ETHERTYPE_IP;
+      break;
 #ifdef DLT_LOOP
     case DLT_LOOP:
 #endif