["Guy Harris" <gharris@xxxxxxxxx>]

Stephane GOUD said:
> I have a "raw" PPP in HDLC like framing pcap file and
> I want it to be analyzed by Ethereal.
>
> I create a pcap file using DLT_PPP or DLT_PPP_SERIAL
> link type but without success.

The OSes that let you capture PPP traffic going to or from the host supply
the packets to the packet capture mechanism *after* the framing and
byte-stuffing have been stripped out; therfore, neither DLT_PPP nor
DLT_PPP_SERIAL are supposed to, or expected to, contain raw byte sequences
from the serial line, they're supposed to contain separate packets with
the framing and byte-stuffing removed.

If you want to create a libpcap file, remove the 0x7e's and 0x7d's from
the stream.

If you want to create a file with a raw byte stream, see the pppdump file
format; it's handled by wiretap/pppdump.c.