diff --git a/netdissect.h b/netdissect.h

index 4f3c666a..93fa8be6 100644

--- a/netdissect.h

+++ b/netdissect.h

@@ -465,6 +465,7 @@ extern u_int raw_if_print IF_PRINTER_ARGS;

 extern u_int sl_bsdos_if_print IF_PRINTER_ARGS;

 extern u_int sl_if_print IF_PRINTER_ARGS;

 extern u_int sll_if_print IF_PRINTER_ARGS;

+extern u_int sll2_if_print IF_PRINTER_ARGS;

 extern u_int sunatm_if_print IF_PRINTER_ARGS;

 extern u_int symantec_if_print IF_PRINTER_ARGS;

 extern u_int token_if_print IF_PRINTER_ARGS;

diff --git a/print-sll.c b/print-sll.c

index 571b7c5e..5a4e2f68 100644

--- a/print-sll.c

+++ b/print-sll.c

@@ -84,6 +84,21 @@ struct sll_header {

 	uint16_t	sll_protocol;	/* protocol */

 };

+/*

+ * A DLT_LINUX_SLL2 fake link-layer header.

+ */

+#define SLL2_HDR_LEN	20		/* total header length */

+

+struct sll2_header {

+	uint16_t	sll2_protocol;		/* protocol */

+	uint16_t	sll2_reserved_mbz;	/* reserved - must be zero */

+	uint32_t	sll2_if_index;		/* 1-based interface index */

+	uint16_t	sll2_hatype;		/* link-layer address type */

+	uint8_t		sll2_pkttype;		/* packet type */

+	uint8_t		sll2_halen;		/* link-layer address length */

+	u_char		sll2_addr[SLL_ADDRLEN];	/* link-layer address */

+};

+

 /*

  * The LINUX_SLL_ values for "sll_pkttype"; these correspond to the

  * PACKET_ values on Linux, but are defined here so that they're

@@ -308,3 +323,192 @@ recurse:

 	return (hdrlen);

 }

+

+static void

+sll2_print(netdissect_options *ndo, const struct sll2_header *sllp, u_int length)

+{

+	u_short ether_type;

+

+	ndo->ndo_protocol = "sll2";

+       ND_PRINT((ndo,"ifindex %u ", EXTRACT_32BITS(&sllp->sll2_if_index)));

+

+	/*

+	 * XXX - check the link-layer address type value?

+	 * For now, we just assume 6 means Ethernet.

+	 * XXX - print others as strings of hex?

+	 */

+	if (EXTRACT_8BITS(&sllp->sll2_halen) == 6)

+		ND_PRINT((ndo, "%s ", etheraddr_string(ndo, sllp->sll2_addr)));

+

+	if (!ndo->ndo_qflag) {

+		ether_type = EXTRACT_16BITS(&sllp->sll2_protocol);

+

+		if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {

+			/*

+			 * Not an Ethernet type; what type is it?

+			 */

+			switch (ether_type) {

+

+			case LINUX_SLL_P_802_3:

+				/*

+				 * Ethernet_802.3 IPX frame.

+				 */

+				ND_PRINT((ndo, "802.3"));

+				break;

+

+			case LINUX_SLL_P_802_2:

+				/*

+				 * 802.2.

+				 */

+				ND_PRINT((ndo, "802.2"));

+				break;

+

+			default:

+				/*

+				 * What is it?

+				 */

+				ND_PRINT((ndo, "ethertype Unknown (0x%04x)",

+				    ether_type));

+				break;

+			}

+		} else {

+			ND_PRINT((ndo, "ethertype %s (0x%04x)",

+			    tok2str(ethertype_values, "Unknown", ether_type),

+			    ether_type));

+		}

+		ND_PRINT((ndo, ", length %u: ", length));

+	}

+}

+

+/*

+ * This is the top level routine of the printer.  'p' points to the

+ * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,

+ * 'h->len' is the length of the packet off the wire, and 'h->caplen'

+ * is the number of bytes actually captured.

+ */

+u_int

+sll2_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)

+{

+	u_int caplen = h->caplen;

+	u_int length = h->len;

+	const struct sll2_header *sllp;

+	u_short ether_type;

+	int llc_hdrlen;

+	u_int hdrlen;

+

+	ndo->ndo_protocol = "sll2";

+	if (caplen < SLL2_HDR_LEN) {

+		/*

+		 * XXX - this "can't happen" because "pcap-linux.c" always

+		 * adds this many bytes of header to every packet in a

+		 * cooked socket capture.

+		 */

+		ND_PRINT((ndo, " [|%s]", ndo->ndo_protocol));

+		return (caplen);

+	}

+

+	sllp = (const struct sll2_header *)p;

+#ifdef HAVE_NET_IF_H

+	uint32_t if_index = EXTRACT_32BITS(&sllp->sll2_if_index);

+	if (!if_indextoname(if_index, ifname))

+		strncpy(ifname, "?", 2);

+	ND_PRINT((ndo, "%-5s ", ifname));

+#endif

+

+	ND_PRINT((ndo, "%-3s ",

+		tok2str(sll_pkttype_values, "?", EXTRACT_8BITS(&sllp->sll2_pkttype))));

+

+	if (ndo->ndo_eflag)

+		sll2_print(ndo, sllp, length);

+

+	/*

+	 * Go past the cooked-mode header.

+	 */

+	length -= SLL2_HDR_LEN;

+	caplen -= SLL2_HDR_LEN;

+	p += SLL2_HDR_LEN;

+	hdrlen = SLL2_HDR_LEN;

+

+	ether_type = EXTRACT_16BITS(&sllp->sll2_protocol);

+

+recurse:

+	/*

+	 * Is it (gag) an 802.3 encapsulation, or some non-Ethernet

+	 * packet type?

+	 */

+	if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {

+		/*

+		 * Yes - what type is it?

+		 */

+		switch (ether_type) {

+

+		case LINUX_SLL_P_802_3:

+			/*

+			 * Ethernet_802.3 IPX frame.

+			 */

+			ipx_print(ndo, p, length);

+			break;

+

+		case LINUX_SLL_P_802_2:

+			/*

+			 * 802.2.

+			 * Try to print the LLC-layer header & higher layers.

+			 */

+			llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);

+			if (llc_hdrlen < 0)

+				goto unknown;	/* unknown LLC type */

+			hdrlen += llc_hdrlen;

+			break;

+

+		default:

+			/*FALLTHROUGH*/

+

+		unknown:

+			/* packet type not known, print raw packet */

+			if (!ndo->ndo_suppress_default_print)

+				ND_DEFAULTPRINT(p, caplen);

+			break;

+		}

+	} else if (ether_type == ETHERTYPE_8021Q) {

+		/*

+		 * Print VLAN information, and then go back and process

+		 * the enclosed type field.

+		 */

+		if (caplen < 4) {

+			ND_PRINT((ndo, "[|vlan]"));

+			return (hdrlen + caplen);

+		}

+		if (length < 4) {

+			ND_PRINT((ndo, "[|vlan]"));

+			return (hdrlen + length);

+		}

+	        if (ndo->ndo_eflag) {

+			uint16_t tag = EXTRACT_16BITS(p);

+

+			ND_PRINT((ndo, "%s, ", ieee8021q_tci_string(tag)));

+		}

+

+		ether_type = EXTRACT_16BITS(p + 2);

+		if (ether_type <= MAX_ETHERNET_LENGTH_VAL)

+			ether_type = LINUX_SLL_P_802_2;

+		if (!ndo->ndo_qflag) {

+			ND_PRINT((ndo, "ethertype %s, ",

+			    tok2str(ethertype_values, "Unknown", ether_type)));

+		}

+		p += 4;

+		length -= 4;

+		caplen -= 4;

+		hdrlen += 4;

+		goto recurse;

+	} else {

+		if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) {

+			/* ether_type not known, print raw packet */

+			if (!ndo->ndo_eflag)

+				sll2_print(ndo, sllp, length + SLL2_HDR_LEN);

+			if (!ndo->ndo_suppress_default_print)

+				ND_DEFAULTPRINT(p, caplen);

+		}

+	}

+

+	return (hdrlen);

+}

diff --git a/print.c b/print.c

index b9c92adc..4cc35bab 100644

--- a/print.c

+++ b/print.c

@@ -126,6 +126,9 @@ static const struct printer printers[] = {

 #ifdef DLT_LINUX_SLL

 	{ sll_if_print,		DLT_LINUX_SLL },

 #endif

+#ifdef DLT_LINUX_SLL2

+	{ sll2_if_print,	DLT_LINUX_SLL2 },

+#endif

 #ifdef DLT_FR

 	{ fr_if_print,		DLT_FR },

 #endif

diff --git a/ethertype.h b/ethertype.h

index f38ec8e4..7719a6f0 100644

--- a/ethertype.h

+++ b/ethertype.h

@@ -19,6 +19,13 @@

  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

  */

+/*

+ * Maximum length of the length field in an Ethernet header; any value

+ * greater than this is not a length value, so it's either an Ethernet

+ * type or an invalid value.

+ */

+#define        MAX_ETHERNET_LENGTH_VAL 1500

+

 /*

  * Ethernet types.

  *

diff --git a/config.h.in b/config.h.in

index 4fcbba77..8ae16730 100644

--- a/config.h.in

+++ b/config.h.in

@@ -78,6 +78,9 @@

 /* Define to 1 if you have the <netinet/if_ether.h> header file. */

 #undef HAVE_NETINET_IF_ETHER_H

+/* Define to 1 if you have the <net/if.h> header file. */

+#undef HAVE_NET_IF_H

+

 /* Define to 1 if you have the <net/if_pflog.h> header file. */

 #undef HAVE_NET_IF_PFLOG_H

diff --git a/configure b/configure

index eb33db18..f64c4eea 100755

--- a/configure

+++ b/configure

@@ -4037,7 +4037,7 @@ fi

 done

-for ac_header in fcntl.h rpc/rpc.h rpc/rpcent.h

+for ac_header in fcntl.h rpc/rpc.h rpc/rpcent.h net/if.h

 do :

   as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`

 ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"

diff --git a/configure.ac b/configure.ac

index 32f48b60..46f841c0 100644

--- a/configure.ac

+++ b/configure.ac

@@ -24,7 +24,7 @@ AC_PROG_CC_C99

 	fi

 fi

-AC_CHECK_HEADERS(fcntl.h rpc/rpc.h rpc/rpcent.h)

+AC_CHECK_HEADERS(fcntl.h rpc/rpc.h rpc/rpcent.h net/if.h)

 AC_CHECK_HEADERS(net/pfvar.h, , , [#include <sys/types.h>

 #include <sys/socket.h>

 #include <net/if.h>])

diff --git a/print-sll.c b/print-sll.c

index 96031442..e6c7bd4a 100644

--- a/print-sll.c

+++ b/print-sll.c

@@ -25,6 +25,10 @@

 #include "config.h"

 #endif

+#ifdef HAVE_NET_IF_H

+#include <net/if.h>

+#endif

+

 #include <netdissect-stdinc.h>

 #include "netdissect.h"

@@ -395,6 +399,9 @@ sll2_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char

 	u_short ether_type;

 	int llc_hdrlen;

 	u_int hdrlen;

+#ifdef HAVE_NET_IF_H

+	char ifname[IF_NAMESIZE];

+#endif

 	ndo->ndo_protocol = "sll2";

 	if (caplen < SLL2_HDR_LEN) {

diff --git a/tcpdump.c b/tcpdump.c

index 2bef72c8..0ef21117 100644

--- a/tcpdump.c

+++ b/tcpdump.c

@@ -1978,6 +1978,10 @@ main(int argc, char **argv)

 			    RFileName, dlt_name,

 			    pcap_datalink_val_to_description(dlt));

 		}

+#ifdef DLT_LINUX_SLL2

+		if (dlt == DLT_LINUX_SLL2)

+			fprintf(stderr, "Warning: interface names might be incorrect\n");

+#endif

 	} else {

 		/*

 		 * We're doing a live capture.

diff --git a/tcpdump.c b/tcpdump.c

index 376d9a20..06d3d9b9 100644

--- a/tcpdump.c

+++ b/tcpdump.c

@@ -155,6 +155,7 @@ static int Iflag;			/* rfmon (monitor) mode */

 static int Jflag;			/* list available time stamp types */

 #endif

 static int jflag = -1;			/* packet time stamp source */

+static int oflag = 0;

 static int pflag;			/* don't go promiscuous */

 #ifdef HAVE_PCAP_SETDIRECTION

 static int Qflag = -1;			/* restrict captured packet by send/receive direction */

@@ -515,7 +515,7 @@ show_devices_and_exit (void)

 #define Q_FLAG

 #endif

-#define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#"

+#define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNoOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#"

 /*

  * Long options.

@@ -1340,6 +1341,10 @@ main(int argc, char **argv)

 			++ndo->ndo_Nflag;

 			break;

+		case 'o':

+			oflag++;

+			break;

+

 		case 'O':

 			Oflag = 0;

 			break;

@@ -1932,6 +1932,14 @@ main(int argc, char **argv)

 		show_devices_and_exit();

 #endif

+#if defined(DLT_LINUX_SLL2) && defined(HAVE_PCAP_SET_DATALINK)

+/* Set default linktype DLT_LINUX_SLL2 when capturing on the "any" device */

+		if (device != NULL &&

+		    strncmp (device, "any", strlen("any")) == 0

+		    && yflag_dlt == -1 && oflag > 0)

+			yflag_dlt = DLT_LINUX_SLL2;

+#endif

+

 	switch (ndo->ndo_tflag) {

 	case 0: /* Default */

@@ -2180,7 +2188,8 @@ main(int argc, char **argv)

 			}

 #endif

 			(void)fprintf(stderr, "%s: data link type %s\n",

-				      program_name, yflag_dlt_name);

+				      program_name,

+				      pcap_datalink_val_to_name(yflag_dlt));

 			(void)fflush(stderr);

 		}

 		i = pcap_snapshot(pd);