Ethereal-users: Re: [Ethereal-users] PPP capture in Ethereal

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Tue, 8 Apr 2003 00:13:07 -0700
On Tue, Apr 08, 2003 at 03:00:45PM +0800, Zhou Dong,BISC MS PLM (BJ) wrote:
> My question is why PPP has Ethernet II header ?

Because of the way the Windows networking stack works:

	http://msdn.microsoft.com/library/default.asp?url=/library/en-us/network/hh/network/208mwan_18br.asp

Ethereal uses WinPcap to do packet capture; WinPcap attaches to the
Windows networking stack at the NDIS level, so it - and, therefore, all
applications that use WinPcap, such as Ethereal - gets packets that look
like Ethernet packets, because NDISWAN converts incoming packet from PPP
to LAN format.