output: Add linktype name

Issue: 6954

This commit adds the linktype name to the output stream. The name is
determined from the pcap utility function pcap_datalink_val_to_name
pull/12891/head
Jeff Lucovsky 2 years ago committed by Victor Julien
parent 462091114e
commit a8b9965f69

@ -3573,6 +3573,10 @@
"properties": {
"linktype": {
"type": "integer"
},
"linktype_name": {
"type": "string",
"description": "the descriptive name of the linktype"
}
},
"additionalProperties": false

@ -428,8 +428,16 @@ void EvePacket(const Packet *p, JsonBuilder *js, uint32_t max_length)
return;
}
if (!jb_set_uint(js, "linktype", p->datalink)) {
jb_close(js);
return;
}
const char *dl_name = DatalinkValueToName(p->datalink);
// Intentionally ignore the return value from jb_set_string and proceed
// so the jb object is closed
(void)jb_set_string(js, "linktype_name", dl_name == NULL ? "n/a" : dl_name);
jb_close(js);
}

Loading…
Cancel
Save