Ethereal-dev: Re: [ethereal-dev] PPP decode problem (fwd)

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Sat, 27 Nov 1999 12:47:57 -0800
> LAPB headers start with 0x01 or 0x03, and PPP headers start with 0xFF,
> so we could probably distinguish between those two flavors of
> "Internetwork analyzer" by looking at the first byte of the first frame
> - if it's 0xFF, assume it's PPP, otherwise assume it's LAPB (at least
> until we find out that some *other* type of trace is written out as an
> "Internetwork analyzer" trace).
> 
> I'll look at doing that.

Well, I checked in a change to do that, and Ton's capture now shows up
as a pile of PPP LCP echo requests and replies; Olivier, could you check
to make sure it still correctly reads Sniffer X.25/LAPB captures?