Wireshark-users: Re: [Wireshark-users] Filtering pppoe packets

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 2 Jun 2010 10:27:16 -0700
On Jun 2, 2010, at 10:06 AM, msher3@xxxxxxxxx wrote:

> One question is still opened though-
> Are the offsets of the internal fields of the packets(like *ipheader, *udp etc) also shifted comparing to those under standard packets?

For IP-over-Ethernet packets, the IP header is after the 14-byte Ethernet header, so it starts at an offset of 14 bytes from the beginning of the frame.

For IP-over-PPPoE packets, the PPPoE session header is after the 14-byte Ethernet header, so it starts at an offset of 14 bytes from the beginning of the frame.  That header is 6 bytes long, and is followed by a PPP header, so the PPP header starts at an offset of 20 bytes from the beginning of the frame.  For IPv4 and IPv6 over PPP, the PPP header is 2 bytes, and is followed by the IP header, so the IP header starts at an offset of 22 bytes from the beginning of the frame.