Wireshark · Ethereal-users: Re: [ethereal-users] ethereal-0.8.8: frame-problem with device ippp1

[Claus Wagner <Claus.Wagner@xxxxxxxx>]

Gilbert Ramirez wrote:
> 
> On Mon, May 22, 2000 at 02:49:07PM -0500, Reinhard Nissl wrote:
> >
> >
> > Hi,
> >
> > if I run ethereal on device ippp1, any outgoing frame has 10 additional
> > bytes
> > (e. g. 29 00 0b 00 02 00 3d 00 04 00) in front of the real ip part
> > (starting
> > with 45 ...). Therefore, the ip part is interpreted wrong.
> 
> I'm not sure if this is the same, but token-ring on Linux has a similar
> problem. Outgoing packets have extra bytes after the TR header
> because libpcap sees the packet as its going through the protocol stack,
> not as it appears on the wire. The Linux TR code created a maximum
> size TR header for generated packets, then shortened the TR header
> right before the packet went to the wire.
> 
> 1. Is anyone else using ISDN drivers for Linux? What do they see?
> 

I see the same (also PPP over ISDN on Linux), but it's each second
frame. The output starts with some starting bytes of the PPP frame
itself, e.g., ... FF 03 ... The overhead of each second frame is also
about 10 bytes.

Regards
Claus Wagner