HOME

NAME

ppp_dissect - a point-to-point dissect function

SYNOPSIS

nxt,offset=ppp_dissect(pkt,offset)

ADDITIONAL NOTE:
     packet saved with the record option of pppd must be converted
     you can obtain a libpcap translations with editcap (see man editcap)
     es: editcap -T ppp original_filename libpcap_format_filename

DESCRIPTION

dissect point-to-point frames

                                  PPP Frame
     +----------+----------+----------+
   |   Flag   | Address  | Control  |
   | 01111110 | 11111111 | 00000011 |
   +----------+----------+----------+   

   +----------+-------------+---------+
   | Protocol | Information | Padding |
   | 8/16 bits|      *      |    *    |
   +----------+-------------+---------+
                 reference RFC 1661, 1662

funtion accepts two arguments:
    pkt is a packet reference containing the whole packet to be dissect
    offset is the position inside packet to start dissection

funtion return two values:
    data is a three_long tuple
        it contains (address,control,protocol)
                addres and control  could be absent. In this case the value of each fields in the tuple is None.
                protocol identifies the datagram encapsulated in the Information field.
                    could be: 

       0x8021            IP Control Protocol
       0x8057            IPv6 Control Protocol
       0xc021            Link Control Protocol
       0xc023            Password Authentication Protocol
       0xc025            Link Quality Report
       0xc223            Challenge Handshake Authentication Protocol
       . . . . . .
       . . . . . .

    offset is the original offset plus ppp-lenght