[Paul Ionescu <paul@xxxxxxxx>]

I have tried a X25 over ethernet capture and some strange things happened.
When I captured some data with libpcap, the EthernetII.type was 0x6000
and the ethereal does not recognize the encapsulation.
When I captured some data with RedHat 6.1 modified libpcap , the EthernetII.type
was 0x0805  (ETH_P_X25) and the ethereal recognizes it as X25 packet.
The above captures was performed concurently and then separately, the
effect was the same.
Maybe is a bug in one of libpcap....
The x25 setup was as follows:
In a plain RedHat 6.1,
insmod lapb
insmod lapbether
insmod x25
ifconfig lapb0 up
x25route add 33 lapb0
x25client 44 33
There was just one computer trying to make a X25 call.
Attached are those captures and the x25client.c program.
Another strange thing is that the captured packet size is smaller than
the minimum ethernet packet size.(which I think is 60 bytes).

Maybe I did something wrong with x25 setup.

There are some more differences between the same traffic captured simultaneously with plain libpcap and the new RH 6.1 libpcap.
For instance, in the RH6.1 libpcap :
traffic on loopback interface (lo) is captured as ethernet not as NULL/LOOPBACK which is wrong.
traffic on ppp interface (ppp0) is again captured as ethernet which is wrong.
the bad news is that there are differences in the actual data captured not just in device type.

When I suspect something wrong on the wire  I don't know anymore if is the application wrong or is the capture wrong.

#include <stdio.h>
#include <sys/socket.h>
#include <linux/x25.h>

int main (int argc, char* argv[])
{
	struct sockaddr_x25 x25connect, x25bind;
	int sd = socket(AF_X25, SOCK_SEQPACKET, 0), n;
	char* local = argv[1],
	    * remote = argv[2],
	    * msg = argv[3],
	      bf[2048];
	
	if (sd < 0) {
		perror("opening x25 socket");
		exit(1);
	}

	memset(&x25bind, 0, sizeof(x25bind));
	x25bind.sx25_family = AF_X25;
	memcpy(&x25bind.sx25_addr, local, strlen(local));

	memset(&x25connect, 0, sizeof(x25connect));
	x25connect.sx25_family = AF_X25;
	memcpy(&x25connect.sx25_addr, remote, strlen(remote));

	printf("Connecting to %s...\n", remote);
	fflush(stdout);

	if (bind(sd, (struct sockaddr *)&x25bind, sizeof (x25bind)) < 0) {
		perror("binding x25 socket");
                exit (1);
	}

	if (connect(sd, (struct sockaddr *)&x25connect, sizeof(x25connect)) < 0) {
		perror("Connecting x25 socket");
		exit(1);
	}

	printf("Connected.\n");
	write(sd, msg, strlen(msg));

	if ((n = read(sd, bf, sizeof(bf) - 1)) < 0) {
		perror("reading x25 socket");
		exit(1);
	}

	bf[n] = '\0';
	printf("server said: %s\n", bf);

	close(sd);
}

Attachment: x25_RH61
Description: Binary data

Attachment: x25_RH60
Description: Binary data