Wireshark · Ethereal-dev: Re: [ethereal-dev] PPP decode problem (fwd)

[Olivier Abad <abad@xxxxxxxxxxxxx>]

On sam, nov 27, 1999 at 12:47:57 -0800, Guy Harris wrote:
> > LAPB headers start with 0x01 or 0x03, and PPP headers start with
> > 0xFF, so we could probably distinguish between those two flavors of
> > "Internetwork analyzer" by looking at the first byte of the first
> > frame - if it's 0xFF, assume it's PPP, otherwise assume it's LAPB
> > (at least until we find out that some *other* type of trace is
> > written out as an "Internetwork analyzer" trace).
> > 
> > I'll look at doing that.
> 
> Well, I checked in a change to do that, and Ton's capture now shows up
> as a pile of PPP LCP echo requests and replies; Olivier, could you
> check to make sure it still correctly reads Sniffer X.25/LAPB
> captures?

It works fine.
Here is a Sniffer X.25 capture. The version records in this file an in
the PPP capture are almost identical :

ppp.syc :
{maj_vers = 5, min_vers = 0, time = 0, date = 0, type = 4 '\004', 
  network = 7 '\a', format = 1 '\001', timeunit = 1 '\001', 
  cmprs_vers = 0 '\000', cmprs_level = 0 '\000', rsvd = {1, 3}}

x25.syc :
{maj_vers = 4, min_vers = 40, time = 17048, date = 9811, type = 4 '\004',
  network = 7 '\a', format = 1 '\001', timeunit = 1 '\001',
  cmprs_vers = 0 '\000', cmprs_level = 0 '\000', rsvd = {0, 0}}

Olivier
-- 
The wise and intelligent are coming belatedly to realize that alcohol, and
not the dog, is man's best friend.  Rover is taking a beating -- and he should.
		-- W.C. Fields

Attachment: x25.syc
Description: Binary data