libpcap and PPP

[Andrew Pollock]

On Sun, Nov 10, 2002 at 08:27:40AM -0500, Carter Bullard wrote:
> Hey Yotam,
>    In order to test the changes, does anyone have a
> tcpdump capture file with some DLT_LINUX_SLL packets
> in it?  As many as 100 would be great.

So do you just need a tcpdump capture run on a PPP interface?
 
> Carter
> 
> 
> > -----Original Message-----
> > From: owner-argus-info at lists.andrew.cmu.edu 
> > [mailto:owner-argus-info at lists.andrew.cmu.edu] On Behalf Of 
> > Yotam Rubin
> > Sent: Wednesday, November 06, 2002 4:29 PM
> > To: argus-info at lists.andrew.cmu.edu
> > Subject: Re: libpcap and PPP
> > 
> > 
> > On Wed, Nov 06, 2002 at 11:12:24PM +0200, Yotam Rubin wrote:
> > > Hey,
> > > 
> > > 	In response to Amir's problem, PPP's linktype in pcap has been 
> > > changed from DLT_RAW to DLT_LINUX_SLL. As a result, argus no longer 
> > > works with a PPP interface. Argus' callback array needs to 
> > be updated.
> > > 
> > > 	Regards, Yotam Rubin
> > 
> > It should be further noted that the same callback that 
> > handled DLT_RAW will not handle DLT_LINUX_SLL properly, since 
> > DLT_LINUX_SLL has a 16 byte header.
> > 
> > 
> > 	Regards, Yotam Rubin
> > 
> > 
>