> Normally a NIC or interface providing access to an HDLC link/network would
> perform de-bytestuffing internally before the packets ever get to libpcap.
> Obviously de-bytestuffing a packet twice can corrupt data. Do we really
> want to have de-bytestuffing code in libpcap?
This isn't in libpcap, it's tcpdump.
> Surely at minimum it should be off by default and selectable as an option
> perhaps, if necessary?
No.
The frame format here is something like this:
ethernet{ip{l2tp{hdlc{ppp{ip{gre{ppp{...}}}}}}}}
I'm sniffing at the ethernet level, and I want to see inside as many
headers as I can with tcpdump, so that means de-bitstuffing the HDLC.
Darren
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
