From 7fbbe70e0cf536d31e7905a608f985e54ccdd8ad Mon Sep 17 00:00:00 2001
From: Arnout Engelen <arnouten@bzzt.net>
Date: Sat, 4 Nov 2006 16:59:44 +0000
Subject: [PATCH] it's said libpcap will yield IP packets directly, without
 encapsulating PPP packets, when sniffing a PPP interface.

blindly adding handling code for that...
---
 decpcap.c   | 4 ++++
 decpcap.h   | 2 ++
 nethogs.cpp | 5 +++++
 3 files changed, 11 insertions(+)

diff --git a/decpcap.c b/decpcap.c
index 8f5bf08..3c542a7 100644
--- a/decpcap.c
+++ b/decpcap.c
@@ -209,6 +209,10 @@ void dp_pcap_callback (u_char * u_handle, const struct pcap_pkthdr * header, con
 		case (DLT_PPP):
 			dp_parse_ppp (handle, header, packet);
 			break;
+		case (DLT_RAW):
+		case (DLT_NULL):
+			// just a guess
+			dp_parse_ip (handle, header, packet);
 		default:
 			// TODO maybe error? or 'other' callback?
 			break;
diff --git a/decpcap.h b/decpcap.h
index 103996c..545ddee 100644
--- a/decpcap.h
+++ b/decpcap.h
@@ -55,3 +55,5 @@ int dp_dispatch (struct dp_handle * handler, int count, u_char *user, int size);
 int dp_datalink(struct dp_handle * handle);
 
 int dp_setnonblock (struct dp_handle * handle, int i, char * errbuf);
+
+
diff --git a/nethogs.cpp b/nethogs.cpp
index d9f9980..9741005 100644
--- a/nethogs.cpp
+++ b/nethogs.cpp
@@ -237,6 +237,11 @@ static void help(void)
 	//std::cerr << "		-f : format of packets on interface, default is eth.\n";
 	std::cerr << "		-p : sniff in promiscious mode (not recommended).\n";
 	std::cerr << "		device : device(s) to monitor. default is eth0\n";
+	std::cerr << std::endl;
+	std::cerr << "When nethogs is running, press:\n";
+	std::cerr << " q: quit\n";
+	std::cerr << " m: switch between total and kb/s mode\n";
+
 }
 
 class device {