Wireshark · Ethereal-users: Re: [Ethereal-users] displaying entire ppp packet

["Mr. Adam ALLEN" <adam@xxxxxxxxxxxxxxxxxxxxxxxx>]

> On what OS are you doing this?

Redhat 7.3
> 
> On most if not all OSes, if you're using PPP-over-HDLC-like-framing, the
> PPP driver strips out PPP framing information, and undoes the
> bit-stuffing/byte-stuffing, before supplying the frame to other code in
> the OS, including the code that delivers packets to user-mode programs.
>

I'm assuming it would be HDLC framing since it's over a serial-link.
(pppd bound to /dev/ttyS0). I'm coming at all this from working with
Cisco routers (with nice expensive testers- that unfortunately interface
with G.703 so are no use).


Flag Address and Control, Frame Checking Sequence are not needed

The only bit I'm really interested in are:
Protocol (to determine x00CF - hopefully for NLPID encapsulation) and
Payload... (when using multilink also interested in sequence numbers
etc)... I think that I need to start reading the source code for PPP (it
would be much quicker to quickly capture packets to discover how
PPP(+multilink) works on linux rather than reading source..)


I assume it should be possible to somehow 'tee' into a the com-port
which PPP runs over - and display a raw form of what is traveling down
the link... This approach while a little off-topic, would suffice (even
a pure hex format)


Thanks,
Adam

Attachment: signature.asc
Description: This is a digitally signed message part