Hi,
we found in SUSE, that you removed support of inbound/outbound on linktype
DLT_PPP. See
http://cvs.tcpdump.org/cgi-bin/cvsweb/libpcap/gencode.c?r1=1.185&r2=1.186
with changelog "Feb 14, 2004: Unfortunately, there is no direction flag
for DLT_PPP."
Karsten Keil from SUSE investigated it and send me this informations:
Without inbound/outbound most of the filter rules for ppp is useless.
One goal of this filtering was to avoid that inbound traffic resets the
IDLE timer. And I don't beleave that this is really not supported, since
it did work in the past. In kernel it looks like the first byte of the
data area is used as inbound/ outbound Flag 1:out 0:in, see the code in
ppp_generic bofore the sk_run_filter call, here are 2 bytes inserted
before the data area and the first is set to 1 in sendframe or to 0 in the
receive routine.
Is it any reason why support of inbound/outbound on linktype DLT_PPP was removed?
Thnx in advance for any answers, Petr
--
Best Regards,
Petr Ostadal
Software Developer
---------------------------------------------------------------------
SuSE CR, s.r.o. e-mail: [EMAIL PROTECTED]
Drahobejlova 27 tel: +420 296 542 382
190 00 Praha 9 fax: +420 296 542 374
Czech Republic http://www.suse.cz
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]
