Re: [Ethereal-users] HDLC Capture Support?

[Guy Harris <gharris@xxxxxxxxx>]

On Wed, Sep 11, 2002 at 04:06:27PM -0600, Vermillion, Scott wrote:
> I see that while the standard ISO implementation of HDLC is not currently
> supported by Ethereal, the Cisco variation is.

Ethereal currently only captures on network interfaces, which, on most
OSes, means "devices whose drivers plug into a network intended to
support protocols like the Internet protocols, or IPX, or NBF, or
AppleTalk, or stuff such as that", because the capture mechanisms in
most OSes (or the framework into which the WinPcap capture mechanism
plugs, on Windows) only supports those devices.

Raw HDLC is typically not a protocol atop which stuff such as that is
run directly, as far as I know; typically those protocols would be run
atop PPP, which would, in turn, be run over HDLC (as per RFC 1662 "PPP
in HDLC-like Framing").  As such, typically, the mechanism used by
libpcap/WinPcap (the library Ethereal uses to do capturing) can't
capture on raw HDLC devices, although it might be possible to make
libpcap support it on some OSes (I don't know whether there are any OSes
where that could be done).

Cisco HDLC, however, is really a misnomer, as

	1) it's not really HDLC

and

	2) it includes a PPP-like layer

so it's more like PPP-in-HDLC-like-framing than like raw HDLC.

Ethereal could read captures from other programs that capture on a raw
HDLC link, if somebody knew enough about the format of those captures to
write the code in Ethereal to read them.