> I'm not sure that PPPoE matters because in most cases there is a PPPX > device which one can use to capture just the PPP packets.
There is a "raw" ethernet interface, where you can gather ethernet packets, and a pppoe device, where you can tap either PPPoE packets or PPP packets. In the userland implementations it does not matter, as the PPPoE packets do not exist inside the kernel, and the ppp device has no choice what packets to tap. Our current implementation always taps the PPPoE packets, without choice. Martin - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
