Hi list,
I've captured a Direct Cable Connection on a WinXP machine (see
http://wiki.ethereal.com/SampleCaptures?action=AttachFile&do=get&target=PPP-config.cap).
The thing is that the capture lib(?) creates fake Ethernet headers for
the PPP LCP and NCP packets. These contain " SEND#" or " RECV#" as both
source and destination address, where "#" seems to be a session number
based on modem control signals(?).
Anyway, to make more sense of the direction these PPP frames are going
I've added them to the address resolution file, as per attached patch.
Thanx,
Jaap
Index: wka.tmpl
===================================================================
--- wka.tmpl (revision 16911)
+++ wka.tmpl (working copy)
@@ -190,6 +190,8 @@
09-00-87-90-FF-FF Xyplex-Terminal-Servers
0C-00-0C-00-00/40 ISL-Frame
0D-1E-15-BA-DD-06 HP
+20-52-45-43-56-00/40 Receive
+20-53-45-4E-44-00/40 Send
33-33-00-00-00-00/16 IPv6-Neighbor-Discovery
AA-00-03-00-00-00/32 DEC-UNA
AA-00-03-01-00-00/32 DEC-PROM-AA