Wireshark · Ethereal-dev: [ethereal-dev] PPP dissector patch

[Greg Kilfoyle <gregk@xxxxxxxxxxx>]

Hi,

Below is a patch for proto-ppp.c so that it can handle a compressed (NULL)
address/control field. I check the first byte, and if it's not 0xff then I
assume A/C have been compressed.

Cheers, Greg.
--
Greg Kilfoyle (gregk@xxxxxxxxxxx)



Index: packet-ppp.c
===================================================================
RCS file: /cvsroot/ethereal/packet-ppp.c,v
retrieving revision 1.30
diff -u -r1.30 packet-ppp.c
--- packet-ppp.c	2000/03/27 17:53:19	1.30
+++ packet-ppp.c	2000/04/05 15:58:18
@@ -1135,10 +1135,19 @@
   e_ppphdr   ph;
   proto_item *ti;
   proto_tree *fh_tree = NULL;
+  int        proto_offset;
 
-  ph.ppp_addr = pd[offset+0];
-  ph.ppp_ctl  = pd[offset+1];
-  ph.ppp_prot = pntohs(&pd[offset+2]);
+  if (pd[offset] == 0xff) {
+    ph.ppp_addr = pd[offset+0];
+    ph.ppp_ctl  = pd[offset+1];
+    ph.ppp_prot = pntohs(&pd[offset+2]);
+    proto_offset = offset + 2;
+  }
+  else {
+    /* address and control are compressed (NULL) */
+    ph.ppp_prot = pntohs(&pd[offset]);
+    proto_offset = offset;
+  }
 
   /* load the top pane info. This should be overwritten by
      the next protocol in the stack */
@@ -1155,11 +1164,13 @@
   if(tree) {
     ti = proto_tree_add_item(tree, proto_ppp, 0, 4, NULL);
     fh_tree = proto_item_add_subtree(ti, ett_ppp);
-    proto_tree_add_text(fh_tree, 0, 1, "Address: %02x", ph.ppp_addr);
-    proto_tree_add_text(fh_tree, 1, 1, "Control: %02x", ph.ppp_ctl);
+    if (pd[offset] == 0xff) {
+      proto_tree_add_text(fh_tree, 0, 1, "Address: %02x", ph.ppp_addr);
+      proto_tree_add_text(fh_tree, 1, 1, "Control: %02x", ph.ppp_ctl);
+    }
   }
 
-  if (!dissect_ppp_stuff(pd, offset+2, fd, tree, fh_tree)) {
+  if (!dissect_ppp_stuff(pd, proto_offset, fd, tree, fh_tree)) {
     if (check_col(fd, COL_PROTOCOL))
       col_add_fstr(fd, COL_PROTOCOL, "0x%04x", ph.ppp_prot);
   }