Wireshark · Ethereal-dev: Re: [Ethereal-dev] PPP dissector bug

[Irfan Khan <ikhan@xxxxxxxxxxxx>]

I agree.  This seems to be more of this particular L2TP implementation's 
problem then an ethereal problem.  My bad :)

Thanks,
Irfan

> If my reading of the L2TP spec is correct, then
>
> 	1) those 0x7e's were in the packet by error if they were framing
> 	   bytes
>
> and
>
> 	2) calling the PPP in HDLC-like framing dissector would work.
>
> Note that the ppp_hdlc dissector assumes that Somebody Else has dealt
> with framing and escape bytes, which is the case for, for example:
>
> 	libpcap captures on systems with BPF, as the PPP code hands
> 	incoming packets to BPF *after* processing them and hands
> 	outgoing packets to BPF *before* inserting framing and escape
> 	bytes;
>
> 	Sniffer, etc. captures, where it also appears to process framing
> 	and escape bytes before putting packets into the capture file;
>
> 	pppdump captures, as the pppdump-capture-reading code processes
> 	the framing and escape bytes.
>