Wireshark · Ethereal-dev: Re: [ethereal-dev] grabbing ppp packets

[Guy Harris <gharris@xxxxxxxxxxxx>]

> I've built libpcap-0.4 w/ the patch, ethereal, on 2.2.14-15 w/ udma
> patch, ppp 2.3.10. I only see IP traffic. I do have lcp_echo_interval
> set to watch the connection, so it should be there.
> 
> Now, one interesting thing is - I'm running diald, and even though there
> is a 'sl0' interface active, it doesn't show up in the capture list. Is
> that because libpcap doesn't support slip interfaces?

"pcap-linux.c", at least in the version of "libpcap" I see, doesn't even
support *PPP* interfaces, at least not as DLT_PPP!  No ARPHDR_ type gets
turned into DLT_PPP *or* DLT_SLIP.

That does not bode well for the possibility of getting to see all PPP
traffic on Linux, at least with "libpcap".

What happens if you put "sl0" in the "Interface" combo box and try to
start a capture on it?  That'll indicate whether "libpcap" can open
"sl0" - if it can't, it won't show up in the list of interfaces.