bro/time-machine — pull request #3 by mareq (2014-04-10 10:04:05+00:00)
Title: Correct handling of Linux SLL header and VLAN headers.

In case libpcap is instructed to capture "any" interface, Linux "cooked" capture encapsulation a.k.a. Linux SLL link layer header will be used (instead of e.g. Ethernet header). Timemachine always blindly assumed Ethernet header and tried to parse it even if there was something completely different (note that Ethernet and Linux SLL are by far not the only two link layer headers that may be encountered).

There was also a problem with VLAN header, where Timemachine always blindly assumed that there is single VLAN header encapsulating IPv4 header. First, several VLAN headers MAY be encapsulated in one another. Second, there is no guarantee that IPv4 header will be used.

As all these problems were present in single piece of code, all of them have been solved by this patch.