> Would it be better to split ether_if_print(), and allow ISL packets
> to recurse into ether_if_print2()?
I was thinking along the same lines myself, actually.
> + p += 12;
> ..
> + caplen -= (16 + ETHER_HDRLEN);
> + length -= (16 + ETHER_HDRLEN);
> + p += ETHER_HDRLEN;
>
> Why 12 + ETHER_HDRLEN vs. 16 + ETHER_HDRLEN?
I'm looking at the diagram at
http://www.cisco.com/warp/public/741/4.html
After having passed the start of the ISL packet (the first 14 bytes),
there's a further 12 bytes to get to the regular Ethernet packet that's
encapsulated in ISL (these are the bytes starting with 0xaa). However,
at the end of the ISL-encapsulated packet there's the regular CRC, and
I was thinking that I therefore needed to subtract a further 4 bytes
from caplen and length.
> I started writing this code but put it in the "case OUI_CISCO:" around
> line 224; was I missing something that required it being outside the
> case?
I think it would work just fine to have it there.
Steinar Haug, Nethelp consulting, [EMAIL PROTECTED]
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
