Guy Harris wrote:
>
>On Thursday, July 3, 2003, at 2:34 AM, Sebastien Jean wrote:
>
>> Is it possible to see the establishment of a PPP connection by using
>> the
>> last version of ethereal on a Linux Redhat 7.3 ?
>
>If by "establishment of a PPP connection" you're referring to all the
>xyzzyCP protocols (LCP, IPCP, etc.) that might be used when setting up
>a PPP connection, the answer is, unfortunately, "probably not", as
>Linux PPP implementations don't supply those packets to the rest of the
>networking stack, and thus the networking stack can't supply them to
>libpcap, and thus libpcap can't supply them to applications that use
>it, such as tcpdump, Snort, Ethereal, etc..
>
>You should be able to see IP traffic over the connection, but that's
>probably all you'll see.
>
There is something called pppdump on Linux, I think. I'm not using Linux.
It seems that pppd can be configured to generate some logfiles that can be read either by pppdump or by Ethereal/Tethereal.
http://www.ethereal.com/lists/ethereal-dev/200009/msg00002.html
http://www.ethereal.com/lists/ethereal-dev/200009/msg00024.html
http://www.ethereal.com/lists/ethereal-dev/200210/msg00052.html