cw@xxxxxxxxxx wrote:
ppp[0:2]=0xc021 is a capture filter, not dispaly filter.
I have solved this problem, because in my case, ppp is encapsulated in
PPPoE, not directly in Ether,
Presumably you mean "PPP is encapsulated over Ethernet using PPPoE,
rather than being the link layer".
so ppp[0:2]=0xc021 can not capture PPP LCP
packets.
At least with the current top-of-tree CVS version of libpcap, the expression
pppoes and ppp proto 0xc021
should do what you want (assuming there is any LCP traffic in the PPPoE
session).