Re: Patch to print out IP data in PPP HDLC packets

[Darren Reed <darrenr () reed wattle id au>]

> Normally a NIC or interface providing access to an HDLC link/network would 
> perform de-bytestuffing internally before the packets ever get to libpcap. 
> Obviously de-bytestuffing a packet twice can corrupt data. Do we really 
> want to have de-bytestuffing code in libpcap?

This isn't in libpcap, it's tcpdump.

> Surely at minimum it should be off by default and selectable as an option 
> perhaps, if necessary?

No.

The frame format here is something like this:

ethernet{ip{l2tp{hdlc{ppp{ip{gre{ppp{...}}}}}}}}

I'm sniffing at the ethernet level, and I want to see inside as many
headers as I can with tcpdump, so that means de-bitstuffing the HDLC.

Darren
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.