Wireshark · Ethereal-dev: [Ethereal-dev] PPP fake ethernet addresses [PATCH]

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Bump
---------- Forwarded message ----------
Date: Wed, 28 Dec 2005 12:56:48 +0100 (CET)

Hi list,

I've captured a Direct Cable Connection on a WinXP machine (see
http://wiki.ethereal.com/SampleCaptures?action=AttachFile&do=get&target=PPP-config.cap).
The thing is that the capture lib(?) creates fake Ethernet headers for
the PPP LCP and NCP packets. These contain " SEND#" or " RECV#" as both
source and destination address, where "#" seems to be a session number
based on modem control signals(?).

Anyway, to make more sense of the direction these PPP frames are going
I've added them to the address resolution file, as per attached patch.

Thanx,
Jaap

Index: wka.tmpl
===================================================================
--- wka.tmpl	(revision 16911)
+++ wka.tmpl	(working copy)
@@ -190,6 +190,8 @@
 09-00-87-90-FF-FF	Xyplex-Terminal-Servers
 0C-00-0C-00-00/40	ISL-Frame
 0D-1E-15-BA-DD-06	HP
+20-52-45-43-56-00/40	Receive
+20-53-45-4E-44-00/40	Send
 33-33-00-00-00-00/16	IPv6-Neighbor-Discovery
 AA-00-03-00-00-00/32	DEC-UNA	
 AA-00-03-01-00-00/32	DEC-PROM-AA