osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

Don't use "if it begins with 0xff 0x03 it's PPP, otherwise it's Cisco 

HDLC" to try to distinguish Cisco HDLC from PPP packets;
Address-and-Control-Field-Compression can be negotiated on, so there's
no guarantee that PPP frames begin with 0xff 0x03.  Fixes bug 2005.

svn path=/trunk/; revision=23535
This commit is contained in:
Guy Harris 2007-11-21 22:16:04 +00:00
parent ceaeb1f977
commit 5bbdbf6efb
1 changed files with 3 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
wiretap/visual.c
View File

@ -430,16 +430,9 @@ static gboolean visual_read(wtap *wth, int *err, gchar **err_info,
/* Fill in the encapsulation. Visual files have a media type in the
file header and an encapsulation type in each packet header. Files
with a media type of HDLC can be either Cisco EtherType or PPP. */
if (wth->file_encap == WTAP_ENCAP_CHDLC_WITH_PHDR)
{
/* examine first two octets to verify encapsulation */
buf = buffer_start_ptr(wth->frame_buffer);
if ((0xff == buf[0]) && (0x03 == buf[1]))
{
/* It is actually PPP */
wth->phdr.pkt_encap = WTAP_ENCAP_PPP_WITH_PHDR;
}
}
if ((wth->file_encap == WTAP_ENCAP_CHDLC_WITH_PHDR) && (vpkt_hdr.encap_hint == 14))
wth->phdr.pkt_encap = WTAP_ENCAP_PPP_WITH_PHDR;
return TRUE;
}