Ethereal-users: RE: [Ethereal-users] Nesting protocols

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Mon, 28 Jun 2004 19:21:31 -0700 (PDT)
Craig, Dave said:
> If netcat respects packet boundaries, would it be possible to avoid
> writing a dissector?

No.  Ethereal's PPP code expects that the framing and de-escaping has
already been done, because, for Ethereal captures from PPP devices on all
the OSes on which libpcap/WinPcap allows programs to capture on PPP
devices, as well as for capture files in all but one capture file format
(pppdump), it *has* already been done (and for pppdump, the low-level code
to read the pppdump file does it, so that it's hidden from Ethereal). 
(Also, the type of framing and escaping isn't the same for all PPP
captures - it might be HDLC-style framing with bit stuffing, for example,
or it might be PPPoE-style or GRE-style or GTP-style or L2TP-style or...
tunneling.)