Re: Patch to print out IP data in PPP HDLC packets

[Hannes Gredler <hannes () juniper net>]

darren,

see questions/responses inline;

On Fri, Jul 02, 2004 at 01:28:20AM +1000, Darren Reed wrote:
| In some email I received from Hannes Gredler, sie wrote:
| > darren,
| > 
| > can we have a .pcap sample showing such a frame for
| > the /tests directory ?
| 
| I've semi-hand constructed this file because of privacy
| concerns about the real data.

you can send it to me unicast then i am not going to publish it;

--

i have some questions wrt to the format based on the .pcap
file that you supplied;

the 1st byte 0x7e seems to introduce a HDLC frame;

after that i can see 4 different frame formats:


frame 1     0x0000:  2145 0000 6edc 5a00 006a 2f52 080a 1122
            0x0010:  330a 1133 4430 8188 0b00 4ad4 9d5a 5a5a
            0x0020:  5a5a 5a5a 5a5a 5a5a 5a5a 5a5a 5a5a 5a5a
            0x0030:  5a5a 5a5a 5a5a 5a5a 5a5a 5a5a 5a5a 5a5a
            0x0040:  5a5a 5a5a 5a5a 5a5a 5a5a 5a5a 5a5a 5a5a
            0x0050:  5a5a 5a5a 5a5a 5a5a 5a5a 5a5a 5a5a 5a5a
            0x0060:  5a5a 5a5a 5a5a 5a5a 5a5a 5a5a 5a7d 5d7d
            0x0070:  5d

this seems to be some sort of shortcut IP frame ... 21 being
codepoint for IPv4; should be use then 0x57 for IPv6 ?


frame 2     0x0000:  c021 7d29 5d7d 207d 2860 89ca 54ff

this looks like a LCP frame , correct ? so the second
format is a fully blown PPP proto-id;


frame 3     0x0000:  ff03 c021 0a5d 0008 5241 249e 8531

looks like a regular PPP frame ... 0xff03 followed by a proto-id

frame 4     0x0000:  ff03 0021 4500 0067 616e 0000 802f 0000
            0x0010:  0a01 2233 0a11 2233 3001 880b 0047 43e4
            0x0020:  0000 005a 5a5a 5a5a 5a5a 5a5a 5a5a 5a5a
            0x0030:  5a5a 5a5a 5a5a 5a5a 5a7d 5e5a 5a5a 5a5a
            0x0040:  5a5a 5a5a 5a5a 5a5a 5a5a 5a5a 5a5a 5a5a
            0x0050:  5a5a 5a5a 5a5a 5a5a 5a5a 5a7d 5d5a 5a5a
            0x0060:  5a5a 5a5a 5a5a 5a5a 5a5a 5a5a 5a5a}

frame 5     0x0000:  ff03 c021 0a5e 0008 5241 249e eb99

same as 4 ...


frame 6     0x0000:  ff7d 23c0 217d 2126 7d20 7d34 7d22 7d26
            0x0010:  7d20 7d20 7d20 7d20 7d25 7d26 65f1 b237
            0x0020:  7d27 7d22 7d28 7d22 3c6b

ok this one i have some problems with ... 0xc021 looks like LCP
again but what is 0xff7d23 ?

except like frame 6 i would formulate the encoding logic like:

test for 0xff03 -> call ppp_print()
test for 0x21 -> call ip_print()
test for 0x57 -> call ip6print()

default: -> call ppp_handle()

---


could you maybe also provide a pointer to a spec where the escaping
routines and or the 0x7e escape hack is described ?

wrt the curly bracket at the end of the hexdump -that not a bug
this is an artifact of the l2tp dissector and i'll also have
a look at that;

/hannes
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.