Ethereal-dev: Re: [Ethereal-dev] pppdump

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 8 Oct 2002 11:38:52 -0700
On Tue, Oct 08, 2002 at 10:08:27AM -0400, Devin Heitmueller wrote:
> Do your comments regarding the differences in the way PPP data is
> announced also refer to the use of the pppd capture mode?

No.  pppd saves all bytes sent and received (including, at least from
one pppd capture I've seen, login traffic before PPP starts running), so
you'll see the control-protocol packets, and the full header.

It also isn't part of the kernel's networking stack (although it
presumably receives packets from and injects packets into that stack),
so it doesn't suffer from the data and mac.raw confusion that several
Linux kernel networking modules appear to.

> If I use the
> raw traffic saves generated by the user-mode PPP daemon, do I avoid the
> problems you described in the first half of the email?

Yes.