Re: Filtering pppoe packets

[Guy Harris <guy () alum mit edu>]

On Jun 2, 2010, at 10:06 AM, msher3 () gmail com wrote:

> One question is still opened though-
> Are the offsets of the internal fields of the packets(like *ipheader, *udp etc) also shifted comparing to those under 
> standard packets?

For IP-over-Ethernet packets, the IP header is after the 14-byte Ethernet header, so it starts at an offset of 14 bytes 
from the beginning of the frame.

For IP-over-PPPoE packets, the PPPoE session header is after the 14-byte Ethernet header, so it starts at an offset of 
14 bytes from the beginning of the frame.  That header is 6 bytes long, and is followed by a PPP header, so the PPP 
header starts at an offset of 20 bytes from the beginning of the frame.  For IPv4 and IPv6 over PPP, the PPP header is 
2 bytes, and is followed by the IP header, so the IP header starts at an offset of 22 bytes from the beginning of the 
frame.
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe