Re: [ethereal-users] can I see PPP inside L2TP packets?

[Gilbert Ramirez <gram@xxxxxxxxxx>]

On Mon, Jun 05, 2000 at 01:25:30PM +0200, Luca Risso wrote:
> 
> 
> 
> Here is the sample trace file of a L2TP connection between two PCs.
> 
> LAC IP address is 172.16.175.110
> LNS address is 172.16.246.176
> 
> The trace contain the following actions:
> - LAC opens a new tunnel
> - LAC opens a new call (PPP peers: 172.16.175.106 <---> 172.16.175.107)
> - LAC sends a couple of ping over PPP connection (packets 60-61, 63-64)
> - LAC closes the call
> - LAC closes the tunnel
> 
> No PPP protocol info seems to be shown into the L2TP packet and also the data
> parts of packet number 60 and 63 (ping) doesn't appear in bold font as usual.
> 
> Thanks for your help.
> 
>    Luca Risso
> 
> (See attached file: l2tp.log)

Here's a minimal patch that has L2TP call the PPP dissector when appropriate.
This is happening at the wrong time however; the column information is not
being updated with information from protocols higher than L2TP.
(I know why; but the fix uncovered some more problems. I'll put the complete fix
into Ethereal 0.8.9 which will be out this week).

I imagine that in the very near future Ethereal will have run-time configuration
of whether or not to show tunnelled protocols' info in the packet columns. Hopefully,
we'll decide this on a per-protocol basis (AH-IP-in-IP, GRE, L2TP, PIM, SOCKS, etc.).
We need to add a way for protocol dissectors to register run-time options with
the core Ethereal routines.

Thanks for the trace file!

--gilbert

--- packet-l2tp.c	Mon May  8 22:15:24 2000
+++ ../ethereal-0.8.8-mod/packet-l2tp.c	Tue Jun  6 01:23:06 2000
@@ -53,6 +53,7 @@
 #include <ctype.h>
 #include <glib.h>
 #include "packet.h"
+#include "packet-ppp.h"
 #include "resolv.h"
 
 #define UDP_PORT_L2TP   1701
@@ -355,10 +356,15 @@
             proto_tree_add_uint_format(l2tp_tree,hf_l2tp_code,offset,1,rhcode,
                                        "Zero Length Bit message");
         }
-        if (!CONTROL_BIT(ver)) {  /* Data Messages so we are done */
-	         proto_tree_add_uint_format(l2tp_tree,hf_l2tp_code, (offset +=  4) , (length - 12 )  , rhcode, "Data: ");
-                 return;
-         }
+
+	if (!CONTROL_BIT(ver)) {  /* Data Messages so we are done */
+		 offset += 4;
+		 length -= 12;
+		 if (IS_DATA_IN_FRAME(offset)) {
+			 dissect_ppp(pd, offset, fd, tree);
+		 }
+		 return;
+	}
 
 	offset += 4;
 	while (index < length ) {    /* Process AVP's */