This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

We are currently working with Wireshark version 1.0.13 to parse "PPP protocol" over previously recorded pcap file. When we open our pcap file, "PPP headers" are recognized successfully, also "PPP VJ uncompressed TCP" data can be parsed successfully. On the other hand, "VJ compressed TCP" packets are recognized but not parsed and defines them as "unknown direction".

Does it mean that my Wireshark can not parse those packets with "VJ Compressed TCP"?

I will send a screenshot from our findings so that you can easily observe what's going on if you ask for it.

Eager to wit for your answers,

With all best,

asked 07 Mar '11, 00:26

Chinar's gravatar image

Chinar
1112
accept rate: 0%

edited 07 Mar '11, 02:34

Try dropping the capture file in CloudShark and see what comes out.

(07 Mar '11, 04:34) Jaap ♦

Unfortunately, the compression is done separately for each direction of the PPP traffic, so Wireshark needs to be able to know which direction a packet is going in; not all capture file formats provide that information (and you can't use the source and destination IP addresses to determine that, as those addresses are compressed out of the packets). Pcap format, unfortunately, is one format that doesn't provide it.

permanent link

answered 07 Mar '11, 18:33

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×6
×3
×1

question asked: 07 Mar '11, 00:26

question was seen: 1,859 times

last updated: 07 Mar '11, 18:33

p​o​w​e​r​e​d by O​S​Q​A