Wireshark-users: Re: [Wireshark-users] capture filter of PPP LCP
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 25 Dec 2007 00:50:22 -0800
cw@xxxxxxxxxx wrote:


    ppp[0:2]=0xc021 is a capture filter, not dispaly filter.
    I have solved this problem, because in my case, ppp is encapsulated in
PPPoE, not directly in Ether,
Presumably you mean "PPP is encapsulated over Ethernet using PPPoE, rather than being the link layer". 


so ppp[0:2]=0xc021 can not capture PPP LCP
packets.


At least with the current top-of-tree CVS version of libpcap, the expression

	pppoes and ppp proto 0xc021
should do what you want (assuming there is any LCP traffic in the PPPoE session).