>On Sat, Apr 14, 2001 at 05:41:54PM +0200, Palka Stanislaw wrote:
>> I use modem adsl with kernel 2.4.3 and patch pppoatm-1.
Everything
>> works. But output of tcpdump
>> is very strange:
> >-------------------------------------------
> >tcpdump -tn -i ppp0 not host 195.36.210.20
>On Date: Sat, 21 Apr 2001 01:27:40 -0700 Guy Harris wrote:
>Linux's PPP implementation handles the link layer headers in a way
>that means it doesn't work well with programs such as tcpdump that
>capture packets:
>..........................
Dear,
I tryed last version of tcpdump/libpcap that of 21/04/01 and problem
persist.
And effectively it loks like misunderstanded packets
The most simple test is in one tty:
ping -nc 2 195.36.210.1
PING 195.36.210.1 (195.36.210.1) from 195.36.210.29 : 56(84)
bytes of data.
64 bytes from 195.36.210.1: icmp_seq=0 ttl=64 time=89.499 msec
64 bytes from 195.36.210.1: icmp_seq=1 ttl=64 time=79.084 msec
And in another:
[root@localhost /root]# /usr/sbin/tcpdump -tnex -i ppp0
tcpdump: listening on ppp0
> 0800 100: bad-hlen 0
0040 0040 0110 41c3 24d2 1dc3 24d2 0108
008a c88a 0300 00ad cfe1 3a5c 260d 0008
090a 0b0c 0d0e 0f10 1100 8002 32ec 1213
1415 1617
< 0800 100: 195.36.210.1 > 195.36.210.29: icmp: echo reply (DF)
4500 0054 2986 4000 4001 e6ba c324 d201
c324 d21d 0000 92c8 8a03 0000 adcf e13a
5c26 0d00 0809 0a0b 0c0d 0e0f 1011 1213
1415 1617
> 0800 100: bad-hlen 0
0040 0040 0110 41c3 24d2 1dc3 24d2 0108
00f8 e28a 0301 00ae cfe1 3aec 0b0d 0008
090a 0b0c 0d0e 0f10 1100 8002 32ec 1213
1415 1617
< 0800 100: 195.36.210.1 > 195.36.210.29: icmp: echo reply (DF)
4500 0054 2988 4000 4001 e6b8 c324 d201
c324 d21d 0000 00e3 8a03 0100 aecf e13a
ec0b 0d00 0809 0a0b 0c0d 0e0f 1011 1213
1415 1617
--------------------------------------------------------------------
It looks like outgoing echo REQUEST is misunderstand.
But I think that are also another misunderstand.
If you need some help, I can help you, but I d'ont have so much spare
time to prepare patch compleete.
(To look for all packets generated by kernel)
Thanks for fast response.
Palka Stanislaw
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
