Wireshark · Ethereal-dev: Re: [Ethereal-dev] PPP dissector bug

[Guy Harris <guy@xxxxxxxxxx>]

On Mon, Mar 10, 2003 at 08:40:13PM -0700, Irfan Khan wrote:
> On the other hand if we are removing the escaping as 2661 seems to 
> suggest then would calling the ppp_hdlc dissector on the L2TP's PPP
> payload work?

If my reading of the L2TP spec is correct, then

	1) those 0x7e's were in the packet by error if they were framing
	   bytes

and

	2) calling the PPP in HDLC-like framing dissector would work.

Note that the ppp_hdlc dissector assumes that Somebody Else has dealt
with framing and escape bytes, which is the case for, for example:

	libpcap captures on systems with BPF, as the PPP code hands
	incoming packets to BPF *after* processing them and hands
	outgoing packets to BPF *before* inserting framing and escape
	bytes;

	Sniffer, etc. captures, where it also appears to process framing
	and escape bytes before putting packets into the capture file;

	pppdump captures, as the pppdump-capture-reading code processes
	the framing and escape bytes.