Ethereal-users: Re: [Ethereal-users] Ethereal/libpcap on WAN

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 16 Sep 2003 18:37:39 -0700

On Sep 5, 2003, at 7:17 PM, darren wrote:

The moment the card is set into its encapsulation mode of say "CiscoHDLC", it will automatically stripe away my L2 header. Is there a bug with my card driver/firmware? Guy Harris have suggested earleir that this is likely to be a problem with the driver/firmware, but my card vendors have strongly insisted that theres nothing wrong and highlighted that the card is working fine with ipchains as proof of its operability in Linux.

"Operability in Linux" in what sense? Does the ipchains stuff look at the link-layer header by using mac.raw? If not, then all they've proven is that it works with ipchains, not that it works with PF_PACKET/SOCK_RAW sockets that attempt to get the entire packet, including the link-layer header (Cisco HDLC header, in this case), by copying data starting at mac.raw.