Argus, libpcap and ppp.

[Carter Bullard]

Hey Yotam,
   You're doing the right thing.  We definitely have
PPP support in argus, but if the lipcap interface
type constants from libpcap don't jive with
with ours then of course there will be a problem.

   Argus may be in error, so let me look to see if
our bpf.h include file is current.  That may be the
only issue.

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter at qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134
http://qosient.com

> -----Original Message-----
> From: owner-argus-info at lists.andrew.cmu.edu 
> [mailto:owner-argus-info at lists.andrew.cmu.edu] On Behalf Of 
> Yotam Rubin
> Sent: Wednesday, November 07, 2001 2:00 PM
> To: argus at lists.andrew.cmu.edu
> Subject: Argus, libpcap and ppp.
> 
> 
> Greetings,
> 
> 	I recently received a bug report against argus 
> indicating that argus does not handle ppp. Evidently, 
> pcap_datalink() in ArgusInitSource() returns DLT_RAW even 
> when handling a ppp interface. DLT_RAW is not supported, thus 
> causing argus to exit. I confirmed this libpcap behavior 
> outside argus. I'm using Debian's libpcap 0.6.2. I want to 
> discuss the problem here prior to migrating the discussion to 
> some libpcap related mailing list. 
> Any ideas? BTW, the problem can be worked around by 
> exchanging DLT_RAW's and DLT_PPP values in include/net/bpf.h, 
> provided that you do not recompile libpcap using the modified 
> header files. Am I doing something wrong or what?
> 
> 	Regards, Yotam Rubin
> 
>