[lkml]   [1997]   [Feb]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Troubles with tcpdump
On Wed, 19 Feb 1997 08:43:24 -0500, (Dale R. Worley) wrote:
>I've just started using tcpdump (tcpdump-3.0.4-1, kernel 2.0.23), and
>it works fine on Ethernet and loopback devices, but seems to be deaf
>for PPP devices. Does anyone know why this is?

Possibly because of this problem. Mailed to linux-net and linux-ppp,
not one response :(. I have tried tracking it down myself but I do not
understand how packets are fed from kernel to tcpdump.

From: Keith Owens <>
Subject: tcpdump expects PPP protocol number, missing
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Sun, 02 Feb 1997 19:02:57 +1100
Sender: root@ocs4.ocs_net

Linux 2.0.24, ppp 2.2.0f, tcpdump 3.3 (the official Linux version).

"tcpdump -nl -ippp0" works fine and dumps everything coming down the
link. "tcpdump -nl -ippp0 select" shows nothing, for any select value
including ip, icmp, tcp, udp, host a.b.c.d etc. This is not a new
problem, I've seen it since 1.3.54 at tcpdump 3.2 (at least) and it is
still in 2.1.24, I just got annoyed enough to go hunting.

The problem is the tcpdump generated filter code expects the PPP
packets to have a 4 byte encapsulation with x'0021' in bytes 2-3.
kdebug shows incoming packets are fine, 'FF 03 00 21 45 00 00 54',
exactly what tcpdump expects. However by the time the packet gets to
tcpdump, the first 4 bytes are zero, '00 00 00 00 45 00 00 54' instead.
tcpdump only checks for the protocol if you add a selection to the
command so a full dump of ppp works fine.

Why are the ppp encapsulation bytes zeroed before passing to tcpdump?
Ethernet 10 encapsulation is passed correctly and "tcpdump -nl -ieth0
select" works.

 \ /
  Last update: 2005-03-22 13:39    [W:0.057 / U:2.832 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site