I have a ppp stream over a serial port. Each ppp packet contains an IP datagram, with an ICMP message (ping). I have removed the HDLC headers (7E FF 03) from the stream, and I have also corrected the characters escaped with 0x7D. I convert this ppp dump using text2pcap -l 9 (DLT_PPP protocol), but in the resulting pcap file, only the first ppp packet is decoded, as you can see in the following image:
I have checked the IP length, and it is right. I have also compared my capture with "ppp-dialup-munged.pcap" in https://wiki.wireshark.org/PPP and, in both captures, packets have a two-byte FCS after the IP datagram, just before the next packet. Why in my case the next packet is not decoded? Should I signal in the raw file where the next packet begins? The raw file I convert with text2pcap is: New packets should start in 0x000000, 0x000040, 0x000080 and 0x0000C0 (the begining is 00 21, IP protocol). Thanks in advance. asked 07 Jul '15, 01:38  jcibar edited 07 Jul '15, 01:42 |
2 Answers:
There are 4 64 bytes PPP frames in the data so you must add the max packet length parameter to text2pcap of When viewing the capture in Wireshark you should also set the PPP protocol preference "PPP Frame Checksum Type" to "16-Bit". answered 07 Jul '15, 02:05  grahamb ♦ |
Finally, I solved the issue restarting the byte count digits when a new packet starts (that is, the new packet starts with 000000): Thanks for your help. answered 09 Jul '15, 06:37 jcibar |
