Re: PPPoE problem.

["Gisle Vanem" <giva () bgnett no>]

"Julio" <magn0lia () virgilio it> said:

> I have some problems to sniff pppoe traffic.
> If I have a simple filter rule like "tcpdump 'not port 4662'" it doesnt
> filter.

Because PPPoE doesn't carry IPv4 traffic directly after the Ether
header, tcpdump doesn't (AFAIK) grok it as IP traffic. I think you must
filter out the correct ether-type first. PPPoE uses two ether-protocols;
either "Discovery" (0x8863) or "Session" (0x8864)

So try 'tcpdump ether proto 0x8864' to capture the session
packets.

--gv

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe