Re: [tcpdump-workers] Patch to print out IP data in PPP HDLC packets

2004-07-05 Thread Guy Harris
On Mon, Jul 05, 2004 at 06:27:24PM +1000, Darren Reed wrote: > The frame format here is something like this: > > ethernet{ip{l2tp{hdlc{ppp{ip{gre{ppp{... ...i.e., as opposed to ethernet{ip{l2tp{ppp{ip{gre{ppp{...}}} - This is the tcpdump-workers list. Visit https://lists.sand

Re: [tcpdump-workers] Patch to print out IP data in PPP HDLC packets

2004-07-05 Thread Darren Reed
> Normally a NIC or interface providing access to an HDLC link/network would > perform de-bytestuffing internally before the packets ever get to libpcap. > Obviously de-bytestuffing a packet twice can corrupt data. Do we really > want to have de-bytestuffing code in libpcap? This isn't in libpc

Re: [tcpdump-workers] Patch to print out IP data in PPP HDLC packets

2004-07-04 Thread Stephen Donnelly
Normally a NIC or interface providing access to an HDLC link/network would perform de-bytestuffing internally before the packets ever get to libpcap. Obviously de-bytestuffing a packet twice can corrupt data. Do we really want to have de-bytestuffing code in libpcap? Surely at minimum it should

Re: [tcpdump-workers] Patch to print out IP data in PPP HDLC packets

2004-07-02 Thread Darren Reed
In some email I received from Hannes Gredler, sie wrote: > i have some questions wrt to the format based on the .pcap > file that you supplied; > > the 1st byte 0x7e seems to introduce a HDLC frame; > > after that i can see 4 different frame formats: Yes. I thought it might be useful to provide

Re: [tcpdump-workers] Patch to print out IP data in PPP HDLC packets

2004-07-02 Thread Hannes Gredler
On Thu, Jul 01, 2004 at 09:32:26PM +1000, Darren Reed wrote: | I've been using this patch to print IP packets inside PPP HDLC | frames found in raw 1xRTT traffic. I've been able to find few | details on the actual PPP header format apart from what "0x7eff" | means and observing traffic for 0x7e21.

Re: [tcpdump-workers] Patch to print out IP data in PPP HDLC packets

2004-07-02 Thread Guy Harris
On Jul 2, 2004, at 11:07 AM, Hannes Gredler wrote: could you maybe also provide a pointer to a spec where the escaping routines and or the 0x7e escape hack is described ? http://www.ietf.org/rfc/rfc1662.txt "This document describes the use of HDLC-like framing for PPP encapsulated packets.

Re: [tcpdump-workers] Patch to print out IP data in PPP HDLC packets

2004-07-02 Thread Hannes Gredler
darren, see questions/responses inline; On Fri, Jul 02, 2004 at 01:28:20AM +1000, Darren Reed wrote: | In some email I received from Hannes Gredler, sie wrote: | > darren, | > | > can we have a .pcap sample showing such a frame for | > the /tests directory ? | | I've semi-hand constructed this

Re: [tcpdump-workers] Patch to print out IP data in PPP HDLC packets

2004-07-01 Thread Darren Reed
In some email I received from Hannes Gredler, sie wrote: > darren, > > can we have a .pcap sample showing such a frame for > the /tests directory ? I've semi-hand constructed this file because of privacy concerns about the real data. I've also included a new version of the patch (moved the unesc

Re: [tcpdump-workers] Patch to print out IP data in PPP HDLC packets

2004-07-01 Thread Hannes Gredler
darren, can we have a .pcap sample showing such a frame for the /tests directory ? /hannes On Thu, Jul 01, 2004 at 09:32:26PM +1000, Darren Reed wrote: | I've been using this patch to print IP packets inside PPP HDLC | frames found in raw 1xRTT traffic. I've been able to find few | details on t

[tcpdump-workers] Patch to print out IP data in PPP HDLC packets

2004-07-01 Thread Darren Reed
I've been using this patch to print IP packets inside PPP HDLC frames found in raw 1xRTT traffic. I've been able to find few details on the actual PPP header format apart from what "0x7eff" means and observing traffic for 0x7e21. The end result is extra output of the form "{ PPP HDLC IP 1.2.3.4 >