Re: Extra bytes at start when tcpdump'ing ippp device.

Andi Kleen (ak@muc.de)
10 Jul 1998 11:39:47 +0200


David Woodhouse <David.Woodhouse@axiom.demon.co.uk> writes:

> I've just set up our internet gateway with diald and ISDN. However, diald isn't
> behaving correctly because it can't understand the outgoing packets. tcpdump
> (from Red Hat 5.1) doesn't show them correctly either - they all seem to have a
> prefix of ten bytes of crap. What causes this? Is it just that libpcap and
> diald need to be taught about IPPP so that they can strip the headers properly,
> or is the kernel doing something wrong?

Your libpcap does not know about the L2 header length of ippp.

The easiest way to fix it (in 2.1) is to switch to a tcpdump/libpcap
that uses (AF_PACKET, SOCK_DGRAM) instead of (AF_PACKET, SOCK_RAW)[1].
Then the kernel will strip the L2 headers, because libpcap should not
really care about them anyways.

You'll find patches to tcpdump and libpcap to fix that at
ftp.inr.ac.ru:/ip-routing

For 2.0 you would need a tcpdump that understands the ippp frame format.
When I remember it right patches for that are somewhere on ftp.gwdg.de
(but for 2.1 the above patches are definitely better and more generic!)

-Andi

[1] equivalent to the old (AF_INET, SOCK_PACKET)

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu