Guy Harris <guy <at> alum.mit.edu> writes: > OK, so the Direction field and Header_Size fields are always present, and the Header_size field gives the > size of the *optional* fields; if a frame contains N PPP packets, the Header_Size field has the value 5N. > (If Header_Size isn't a multiple of 5, the frame is presumably invalid.) >
I´ve mixed up some field sizes in my previous mail. Msg_ID and Freq_ID have a size of 2 octects, not 1 octect like the other fields, sorry. So the optional part has a size of 7 octects. But your conclusion is correct: The Header_Size is multiple of *7*, if there is a frame with N PPP packets, Header_Size is multiple of 7. If it is not multiple of 7, the frame is not valid. Direction field and Header_Size fields are always present. > > Presumably, if the Start_Pos and End_Pos of one packet overlap the Start_Pos and End_Pos of another > packet, the frame is invalid. Yes, that´s correct. > If there are parts of the MUX_Frame that don't correspond to any packet, is > the frame invalid? > (If so, Start_Pos and End_Pos could presumably be replaced by a length field, and the > only "frame is invalid" case there would be if a frame ran past the end of the MUX_Frame, or the packet were > too short to be a PPP packet.)- > It is possible that a valid Mux_frame (with PPP_frames as payload) has parts that don´t correspond to a PPP packet. Two examples: (1) At the beginning of a PPP connection, a Mux_frame with "CONNECT" (AT mode) and the first PPP packet. (2) A Mux_frame with a LCP Terminate packet (PPP) and a "NO CARRIER" packet (AT mode). Kind regards, Christoph Schemmel - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
