Hi All!
Could you please add support for IP traffic parsing over PPPoE without
encryption?
I think, that it's rather simple. Patch included.
Example packets with IP traffic over PPPoE in libpcap format:
http://ivlan.net/upload/dev/pppoe.cap
Patch: http://ivlan.net/upload/dev/pmacct-sfacttd-pppoe.patch
Sorry for my english.
*** pmacct-0.11.6-orig/src/sfacctd.c 2009-04-28 19:40:21.000000000 +0400
--- pmacct-0.11.6/src/sfacctd.c 2009-04-28 19:42:01.000000000 +0400
***************
*** 957,962 ****
--- 957,970 ----
caplen -= sample->lstk.depth * 4;
}
+ if (sample->eth_type == ETHERTYPE_PPPOE && ptr[6] == 0x00 && ptr[7] == 0x21) {
+ /* IP over 8864 (PPPoE) */
+ ptr += 8;
+ caplen -= 8;
+ /* force the eth_type to be IP so we can inline the IP decode below */
+ sample->eth_type = ETHERTYPE_IP;
+ }
+
if (sample->eth_type == ETHERTYPE_IP) {
sample->gotIPV4 = TRUE;
sample->offsetToIPV4 = (ptr - start);
_______________________________________________
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists
