tcpdump mailing list archives
print_llc code question
From: "Jean-Louis CHARTON" <Jean-Louis.CHARTON () oikialog com>
Date: Tue, 1 Sep 2009 15:55:22 +0200
Hi, Maybe the following question is pretty obvious but since I'm not an 802.2/LLC expert, I can't find a response for it. I was reading print_llc.c code and in llc_print() function, I found something that I don't really understand. At lines 247 to 251, one has : if (ssap == LLCSAP_IP && dsap == LLCSAP_IP && control == LLC_UI) { ip_print(gndo, p+4, length-4); return (1); } Why is ip_print() called with p+4 and length-4 when just a few lines above for the LLCSAP_8021D case or a few lines below for the LLCSAP_IPX case, we have stp_print(p+3, length-3) and ipx_print(p+3, length-3) respectively? The control field is 1 byte long in this case, isn't it? The LLC header should be only 3 bytes long, so I don't understand why it's not ip_print(gndo, p+3, length-3). What's the reason for the extra byte? Thank you for your help. J-L Charton - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- print_llc code question Jean-Louis CHARTON (Sep 01)
- Re: print_llc code question Guy Harris (Sep 01)
- Re: print_llc code question Jean-Louis Charton (Sep 07)
- <Possible follow-ups>
- Re: print_llc code question Alexander Dupuy (Sep 07)
- Re: print_llc code question Guy Harris (Sep 01)