Re: [Ethereal-users] Capture media page online

["Justin C. Walker" <justin@xxxxxxx>]

On Monday, September 2, 2002, at 06:21 , Guy Harris wrote:

> On Mon, Sep 02, 2002 at 06:11:38PM -0500, Justin C. Walker wrote:

> >    Serial (PPP) is cooked only
>
> "Cooked only" in what sense?  Do you get the PPP header (with or without
> an HDLC-like-encapsulation header)?  Do you get control-protocol
> packets?  (The other BSDs should, I think, give you all packets,
> including control protocols, at least with the kernel PPP
> implementation.)

You get only the network-layer packets (I think PPP headers are there, 
but not the control stuff).  PPP for Mac OS X/Darwin is 
kernel-resident.  It (the kernel extension) differs from that in other 
BSDs due in part to the difference between the device layer for Darwin 
and other BSDs.

> > Agreed.  Support for "raw" access for 802.11 is a function of the drive
> > (and the card, I suppose).  For Airport, the driver is closed-source, 
> > so
> > it depends on what Apple decides to do.
>
> I may try to pester Jordan Hubbard about that.  (It might also make the
> Wildpackets people happy, assuming that they use BPF for the MacOS X
> EtherPeek and plan to do an AiroPeek for MacOS X and use BPF for that as
> well.)

Worth a shot.  I'll see what I can do as well.  However, the Airport 
driver is out of Jordan's hands...

Note that at this point, BPF is all there is for 'peeking', unless 
specific drivers provide custom APIs...

Regards,

Justin

--
Justin C. Walker, Curmudgeon-At-Large  *
Institute for General Semantics        |    Men are from Earth.
                                       |    Women are from Earth.
                                       |       Deal with it.
*--------------------------------------*-------------------------------*