On Jan 26, 2011, at 2:30 AM, Schemmel, Hans-Christoph wrote: > The size of the header depends on the number of PPP packets in the payload of > the MUX frame. The Header_Size indicates whether Msg_ID, Freq_ID, Start_Pos, > End_Pos, and Flag are present. > For example: > The header of a frame without PPP packet is > | Header_Size (=0) | Direction | MUX_Frame > > The header of a frame with one PPP packet is > | Header_Size | Msg_ID | Freq_ID | Start_Pos | End_Pos | Flag | Direction | > MUX_Frame > > The header of a frame with two PPP packet is > | Header_Size | Msg_ID | Freq_ID | Start_Pos | End_Pos | Flag | Msg_ID | > Freq_ID | Start_Pos | End_Pos | Flag | Direction | MUX_Frame
OK, so the Direction field and Header_Size fields are always present, and the Header_size field gives the size of the *optional* fields; if a frame contains N PPP packets, the Header_Size field has the value 5N. (If Header_Size isn't a multiple of 5, the frame is presumably invalid.) Is that correct? Presumably, if the Start_Pos and End_Pos of one packet overlap the Start_Pos and End_Pos of another packet, the frame is invalid. If there are parts of the MUX_Frame that don't correspond to any packet, is the frame invalid? (If so, Start_Pos and End_Pos could presumably be replaced by a length field, and the only "frame is invalid" case there would be if a frame ran past the end of the MUX_Frame, or the packet were too short to be a PPP packet.)- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
