81a82 > #define PCAP_DLT_PPP 9 /* Point-to-point Protocol */ 97d97 < #define PCAP_DLT_PPP 9 /* Point-to-point Protocol */ 177a178,219 > > > /* This function determine the offset for the IP packet in a PPP or HDLC PPP frame */ > /* Written by Yann Samama (ysamama@nortelnetworks.com) on june 19th, 2003 */ > static int find_ip_ppp(char* buf) > { > unsigned char ppp_byte0; /* the first byte of the PPP frame */ > unsigned short ppp_proto_type; /* the protocol type field of the PPP header */ > int offset = -1; /* the calculated offset that this function will return */ > > memcpy(&ppp_byte0, buf, 1); > switch (ppp_byte0) > { > case 0xff: /* It is HDLC PPP encapsulation (2 bytes for HDLC and 2 bytes for PPP) */ > memcpy(&ppp_proto_type, buf+2, 2); > ppp_proto_type = ntohs(ppp_proto_type); > if (ppp_proto_type == 0x21) /* That means HDLC PPP is encapsulating IP */ > offset = 4; > else /* That means PPP is *NOT* encapsulating IP */ > offset = -1; > break; > > case 0x21: /* It is raw PPP encapsulation of IP with compressed (1 byte) protocol field */ > offset = 1; > break; > > case 0x00: /* It is raw PPP encapsulation */ > memcpy(&ppp_proto_type, buf, 2); > ppp_proto_type = ntohs(ppp_proto_type); > if (ppp_proto_type == 0x21) /* It is raw PPP encapsulation of IP with uncompressed (2 bytes) protocol field */ > offset = 2; > else /* That means PPP is *NOT* encapsulating IP */ > offset = -1; > break; > > default: /* There is certainly not an IP packet there ...*/ > offset = -1; > break; > } > return offset; > } >