print_llc code question

["Jean-Louis CHARTON" <Jean-Louis.CHARTON () oikialog com>]

Hi,

Maybe the following question is pretty obvious but since I'm not an
802.2/LLC expert, I can't find a response for it.
I was reading print_llc.c code and in llc_print() function, I found
something that I don't really understand.

At lines 247 to 251, one has :

    if (ssap == LLCSAP_IP && dsap == LLCSAP_IP &&
        control == LLC_UI) {
        ip_print(gndo, p+4, length-4);
        return (1);
    }

Why is ip_print() called with p+4 and length-4 when just a few lines
above for the LLCSAP_8021D case or a few lines below for the LLCSAP_IPX
case, we have stp_print(p+3, length-3) and ipx_print(p+3, length-3)
respectively?

The control field is 1 byte long in this case, isn't it? The LLC header
should be only 3 bytes long, so I don't understand why it's not
ip_print(gndo, p+3, length-3). What's the reason for the extra byte?

Thank you for your help.

J-L Charton

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.