Hi,
Maybe the following question is pretty obvious but since I'm not an
802.2/LLC expert, I can't find a response for it.
I was reading print_llc.c code and in llc_print() function, I found
something that I don't really understand.
At lines 247 to 251, one has :
if (ssap == LLCSAP_IP && dsap == LLCSAP_IP &&
control == LLC_UI) {
ip_print(gndo, p+4, length-4);
return (1);
}
Why is ip_print() called with p+4 and length-4 when just a few lines
above for the LLCSAP_8021D case or a few lines below for the LLCSAP_IPX
case, we have stp_print(p+3, length-3) and ipx_print(p+3, length-3)
respectively?
The control field is 1 byte long in this case, isn't it? The LLC header
should be only 3 bytes long, so I don't understand why it's not
ip_print(gndo, p+3, length-3). What's the reason for the extra byte?
Thank you for your help.
J-L Charton
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
