My understanding is that only an org code of 0:0:0 represents
encapsulated ethernet packets, and other org codes have their own
"ethertype" / "protocol" space. Any thoughts on this patch?
Thanks,
Bill
Warning: Server lies about size of server host key: actual size is 1023 bits vs.
announced 1024.
Warning: This may be due to an old implementation of ssh.
Index: print-llc.c
===================================================================
RCS file: /tcpdump/master/tcpdump/print-llc.c,v
retrieving revision 1.36
diff -u -r1.36 print-llc.c
--- print-llc.c 2001/01/28 09:46:43 1.36
+++ print-llc.c 2001/05/09 18:20:01
@@ -187,12 +187,15 @@
length -= sizeof(llc);
p += sizeof(llc);
- /* This is an encapsulated Ethernet packet */
- et = EXTRACT_16BITS(&llc.ethertype[0]);
- ret = ether_encap_print(et, p, length, caplen,
- extracted_ethertype);
- if (ret)
- return (ret);
+ if (llc.orgcode[0] == 0 && llc.orgcode[1] == 0 &&
+ llc.orgcode[1] == 0) {
+ /* This is an encapsulated Ethernet packet */
+ et = EXTRACT_16BITS(&llc.ethertype[0]);
+ ret = ether_encap_print(et, p, length, caplen,
+ extracted_ethertype);
+ if (ret)
+ return (ret);
+ }
}
if ((llc.ssap & ~LLC_GSAP) == llc.dsap) {
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
