X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/c25493a5b51c8d891282ff7456643036ecff133b..4291b4708b2a5d66bcf02c1252ebc816b2a776b1:/print-ppp.c

diff --git a/print-ppp.c b/print-ppp.c
index 9332bcde..3beb0220 100644
--- a/print-ppp.c
+++ b/print-ppp.c
@@ -31,7 +31,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-ppp.c,v 1.42 2000-08-18 08:20:10 itojun Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-ppp.c,v 1.43 2000-09-09 07:06:17 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -1070,6 +1070,36 @@ ppp_if_print(u_char *user, const struct pcap_pkthdr *h,
 	 * actual PPP frame. The 1st octet looks like Input/Output flag
 	 * while 2nd octet is unknown, at least to me
 	 * (mshindo@mshindo.net).
+	 *
+	 * That was what the original tcpdump code did.
+	 *
+	 * FreeBSD's "if_ppp.c" *does* set the first octet to 1 for outbound
+	 * packets and 0 for inbound packets - but only if the
+	 * protocol field has the 0x8000 bit set (i.e., it's a network
+	 * control protocol); it does so before running the packet through
+	 * "bpf_filter" to see if it should be discarded, and to see
+	 * if we should update the time we sent the most recent packet...
+	 *
+	 * ...but it puts the original address field back after doing
+	 * so.
+	 *
+	 * NetBSD's "if_ppp.c" doesn't set the first octet in that fashion.
+	 *
+	 * I don't know if any PPP implementation handed up to a BPF
+	 * device packets with the first octet being 1 for outbound and
+	 * 0 for inbound packets, so I (guy@alum.mit.edu) don't know
+	 * whether that ever needs to be checked or not.
+	 *
+	 * Note that NetBSD has a DLT_PPP_SERIAL, which it uses for PPP,
+	 * and its tcpdump appears to assume that the frame always
+	 * begins with an address field and a control field, and that
+	 * the address field might be 0x0f or 0x8f, for Cisco
+	 * point-to-point with HDLC framing as per section 4.3.1 of RFC
+	 * 1547, as well as 0xff, for PPP in HDLC-like framing as per
+	 * RFC 1662.
+	 *
+	 * (Is the Cisco framing in question what DLT_C_HDLC, in
+	 * BSD/OS, is?)
 	 */
 	if (eflag)
 		printf("%c %4d %02x ", p[0] ? 'O' : 'I', length, p[1]);