[Guy Harris <guy@xxxxxxxxxxxx>]

On Thursday, July 3, 2003, at 2:34 AM, Sebastien Jean wrote:

> Is it possible to see the establishment of a PPP connection by using 
> the
> last version of ethereal on a Linux Redhat 7.3 ?

If by "establishment of a PPP connection" you're referring to all the 
xyzzyCP protocols (LCP, IPCP, etc.) that might be used when setting up 
a PPP connection, the answer is, unfortunately, "probably not", as 
Linux PPP implementations don't supply those packets to the rest of the 
networking stack, and thus the networking stack can't supply them to 
libpcap, and thus libpcap can't supply them to applications that use 
it, such as tcpdump, Snort, Ethereal, etc..

You should be able to see IP traffic over the connection, but that's 
probably all you'll see.