Re: core dump with PPP messages 1 byte long.

[Guy Harris <guy () alum mit edu>]

On Wed, Jul 07, 2004 at 04:21:39PM +1000, Darren Reed wrote:
> IP 1.1.1.1.1701 > 2.2.2.2.1701: l2tp:[TLS](24460/3222)Ns=23239,Nr=647
>    *MSGTYPE(ICCN) *TX_CONN_SPEED(156000) *FRAMING_TYPE(A)
>    *VENDOR0c7f:ATTR0066(00000000000000000000000000) RX_CONN_SPEED(156000)

I'm not sure what the "framing type" in an L2TP session signifies - does
it signify what framing is used for the PPP traffic once it leaves the
L2TP tunnel, or does it (for some not-entirely obvious reason) signify
what framing is used *inside* the tunnel?

RFC 2661 says

   Once tunnel establishment is complete, PPP frames from the remote
   system are received at the LAC, stripped of CRC, link framing, and
   transparency bytes, encapsulated in L2TP, and forwarded over the
   appropriate tunnel. The LNS receives the L2TP packet, and processes
   the encapsulated PPP frame as if it were received on a local PPP
   interface.

which sounds as if you're *not* supposed to send PPP frames over the
wire in RFC 1662 byte-stuffed form.

However, I found some mail on the Ethereal list about packets with RFC
1662 byte-stuffing inside L2TP - and the packets might have been
involved in some 3GPP2 stuff - so perhaps the CDMA2000 folks didn't
bother reading section 5.3 of RFC 2661 carefully, and decided to send
byte-stuffed crud in L2TP packets.

Or perhaps this is some wacky vendor-specific stuff, where they decided
to send extra framing and escaping octets over the network for some
reason; a Google for

        l2tp site:3gpp2.org

didn't find anything.

> But all of the real CDMA/1xRTT stuff is ITU defined (= $$ to obtain.)

What about

        http://www.3gpp2.org/Public_html/specs/index.cfm
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.