Ethereal-users: Re: [Ethereal-users] Capture media page online

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Justin C. Walker" <justin@xxxxxxx>
Date: Tue, 3 Sep 2002 00:26:19 -0500
On Monday, September 2, 2002, at 06:21 , Guy Harris wrote:

On Mon, Sep 02, 2002 at 06:11:38PM -0500, Justin C. Walker wrote:

   Serial (PPP) is cooked only

"Cooked only" in what sense?  Do you get the PPP header (with or without
an HDLC-like-encapsulation header)?  Do you get control-protocol
packets?  (The other BSDs should, I think, give you all packets,
including control protocols, at least with the kernel PPP
implementation.)

You get only the network-layer packets (I think PPP headers are there, but not the control stuff). PPP for Mac OS X/Darwin is kernel-resident. It (the kernel extension) differs from that in other BSDs due in part to the difference between the device layer for Darwin and other BSDs.

Agreed.  Support for "raw" access for 802.11 is a function of the drive
(and the card, I suppose). For Airport, the driver is closed-source, so
it depends on what Apple decides to do.

I may try to pester Jordan Hubbard about that.  (It might also make the
Wildpackets people happy, assuming that they use BPF for the MacOS X
EtherPeek and plan to do an AiroPeek for MacOS X and use BPF for that as
well.)

Worth a shot. I'll see what I can do as well. However, the Airport driver is out of Jordan's hands...

Note that at this point, BPF is all there is for 'peeking', unless specific drivers provide custom APIs...

Regards,

Justin

--
Justin C. Walker, Curmudgeon-At-Large  *
Institute for General Semantics        |    Men are from Earth.
                                       |    Women are from Earth.
                                       |       Deal with it.
*--------------------------------------*-------------------------------*