[EMAIL PROTECTED] wrote:
> ppp[0:2]=0xc021 is a capture filter, not dispaly filter.
> I have solved this problem, because in my case, ppp is encapsulated in
> PPPoE, not directly in Ether,
Presumably you mean "PPP is encapsulated over Ethernet using PPPoE,
rather than being the link layer".
> so ppp[0:2]=0xc021 can not capture PPP LCP
> packets.
At least with the current top-of-tree CVS version of libpcap, the expression
pppoes and ppp proto 0xc021
should do what you want (assuming there is any LCP traffic in the PPPoE
session).
_______________________________________________
Wireshark-users mailing list
Wireshark-users@wireshark.org
http://www.wireshark.org/mailman/listinfo/wireshark-users
