On Sun, Dec 17, 2000 at 04:35:29PM -0800, Guy Harris wrote:
> It could, I guess, for all code in the filter expression that could work
> on PPP, generate code to check the link-layer packet type for PPPoE and,
> if it matches, check that the code field is 0x00 and, if that matches,
> do the appropriate checks for PPPoE.
Of course, PPPoE isn't the only way to send IP over Ethernet other than
in a frame with an Ethernet type of 0x0800; there's also various ways of
stuffing IP inside IP, for example.
BPF code that checks for *all* of them would probably be unwieldy -
consider the perverse example of IP over X.25 over TCP (RFC 1613) over
IP inside GRE inside IP inside PPP inside PPPoE inside a VLAN
encapsulation over Ethernet.
Even handling just GRE encapsulation adds some complication; having to
deal with IP inside GRE inside IP inside PPP inside PPPoE over Ethernet
further complicates things.
So we might want to require the user to specify the encapsulation in
some fashion; the expression would check for that encapsulation, and
only packets of that sort (e.g., PPPoE) would be captured.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
