Aaron, hi! > > > > Could you tell me about two features of tcprewrite: > > > > > > > > 1. can it remove PPPoE headers from ethernet packets in a > > > similar way as it can the vlan tags (--vlan=del). > > > > > > Nope. Code could be easily enhanced to do so though if you're so > > > compelled. > > > > I am affraid I am not enough a programmer to do such a > task. I removed the eth header with --dlt=0 option and got a > packet starting with PPPoE header as one would expect. Is > there another way to simply cut off first 48 bits of a > packet? If so, I would add an eth header and get the needed > form. I noticed that there was a DLT_PPP_ETHER type listed in > dlt_names.h - could this maybe help me somehow? > > This isn't something that tcprewrite can do today. I'm a > little confused though, what do you plan to do with the > packets without the ethernet/PPPoE headers?
I managed to resolve my problem by using bittwiste: 1. I change the DLT type for PPPoE to ETH: bittwiste -I PPPoE_2.cap -O 3.cap -T eth -t ip 2. then I cut off the PPPoE and PPP headers: bittwiste -I 3.cap -O 4.cap -D 15-22 The resulting packet is just a plain eth-ip packet that can be passed to other applications (nprobe in my case) that do not support eth-pppoe-ppp-ip encapsulated traffic. Thanks a lot for you comments. best regards, Matevz ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Tcpreplay-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
