allow to force a cooked capture

Using a datalink header can be used to show packets direction

Author: teknoraver

tcpdump.c

@@ -196,6 +196,7 @@ static int Qflag = -1;			/* restrict captured packet by send/receive direction *
 #ifdef HAVE_PCAP_DUMP_FLUSH
 static int Uflag;			/* "unbuffered" output of dump files */
 #endif
+static int yflag_dlt = -1;
 static int Wflag;			/* recycle output files after this number of files */
 static int WflagChars;
 static char *zflag = NULL;		/* compress each savefile using a specified command (like gzip or bzip2) */
@@ -1315,6 +1316,11 @@ open_interface(const char *device, netdissect_options *ndo, char *ebuf)
 			    pcap_tstamp_type_val_to_name(jflag), device,
 			    pcap_statustostr(status));
 	}
+#endif
+#ifdef __linux__
+	/* SLL is always possible on Linux */
+	if (yflag_dlt == DLT_LINUX_SLL || yflag_dlt == DLT_LINUX_SLL2)
+		pcap_cook(pc);
 #endif
 	status = pcap_activate(pc);
 	if (status < 0) {
@@ -1446,7 +1452,6 @@ main(int argc, char **argv)
 	int cansandbox;
 #endif	/* HAVE_CAPSICUM */
 	int Oflag = 1;			/* run filter code optimizer */
-	int yflag_dlt = -1;
 	const char *yflag_dlt_name = NULL;
 	int print = 0;