Re: capturing 802.11 frames with udp protocol..

[Guy Harris <guy () alum mit edu>]

On Wednesday, July 16, 2003, at 4:18 PM, Justin Robinson wrote:

> Can pcap_datalink() tell me if I'm using PPPoA, as opposed to ethernet 
> and
> 802.11?

It would probably tell you that you're using PPP, *IF* the underlying 
capture mechanism used by libpcap supplies PPP frames to libpcap.  It 
is not always the case that the underlying capture mechanism does - on 
Linux, the PPP drivers generally supply crap, so libpcap falls back on 
"cooked mode" capture, and, on Windows, NDISWAN, at best, supplies fake 
Ethernet frames and, at worst, does all sorts of unpleasant things.

It is conceivable, although probably quite unlikely, that it would 
supply raw ATM frames.

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe