From mboxrd@z Thu Jan 1 00:00:00 1970 From: arthurpaulino Date: Mon, 22 Dec 2014 18:06:36 +0000 Subject: Re: PPP compression Message-Id: MIME-Version: 1 Content-Type: multipart/mixed; boundary="=_00a6429c2bee6501bcb78159a167098b" List-Id: References: <3b4526880d737ed5094d632636e6fef8@great.ufc.br> In-Reply-To: <3b4526880d737ed5094d632636e6fef8@great.ufc.br> To: linux-ppp@vger.kernel.org --=_00a6429c2bee6501bcb78159a167098b Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="utf-8" First, I appreciate all your support. I tried to convert from .pcap to .pppdump and use pppdump (with -p and -d) to decompress the data. But again, the output contains the same data as the compressed packets. The files are attached. I have some questions: 1 - I tried to use pppd with the recording option (pppd record output.pppdump), but all it did was print "~�}#�!}!}!} }4}"}&} } } } }%}&v��}<}'}"}(}">*~" over and over on the terminal. Also, no output file was saved. Am I doing something wrong? 2 - How does pppdump know that he has to use deflate for decompression? On Mon, 22 Dec 2014 07:34:31 -0500, James Carlson wrote: > On 12/21/14 13:37, Michael Richardson wrote: >> James Carlson wrote: >> >> I tried to use pppdump with -p and -d. The input file I used was >> >> the >> >> pcap file (packets.pcap) generated by tcpdump. >> >> > As I said, pppdump and pcap formats are not at all the same. >> > You'll >> > have to convert to go this route. >> >> > Attached is a quick-and-dirty program I wrote to convert from the >> > Linux >> > libpcap variant and PPTP encapsulation you seem to be using and >> > simple >> > pppdump format. I didn't bother with timestamps or other bits. >> > Maybe >> > it'll work for you. >> >> Do you think it would be worth having a tcpdump DLT type for pppdump >> stuff, >> and just wrap it all up into a pcap container? > > It's an interesting idea, and I could see how there might be cases where > it may even be helpful, but I think it's the wrong thing to do. > > These are fundamentally different things. The pppdump stuff, at its > heart, is really an asynchronous serial recording mechanism. It doesn't > know anything about packets or frames or other such L2 nonsense. It > just records bytes going in and out in a format that can preserve > interesting information such as timing. > > The original purpose of it was to record low-level async data to reveal > communications problems that caused AHDLC to go off the rails. You > would not (ordinarily) want to use it to debug some sort of PPP, IP, or > higher-level problem. Instead, you'd use the existing raw packet > mechanisms to record the packets. > > In fact, when you're using pppd's "record" option (which saves data in > the pppdump format), it actually forks up a separate relay process and > runs PPP over a pty pair instead of the user's specified serial port. > That relay process is what saves the data while copying data back and > forth between the serial port and the pty. It's a brutal trip back and > forth in and out of the kernel multiple times on each packet, and the > original data are (unfortunately) sometimes mangled in the process due > to pty and serial port issues. > > It would probably be nice to have some sort of raw recording mechanism > for AHDLC's in-kernel decoder (and perhaps HDLC frames as well, for PPP > over synchronous lines) so that packet capture tools can get better > low-level data, but I don't think this is the right long-term mechanism. > > I suggested pppdump as a way out for this particular case because this > one user wants to decode compressed data, and this is one thing that > pppdump happens to know how to do (albeit in a very limited way). > > tcpdump datalink type values are, I think, a higher-level concept. > > A better path forward for the original poster's problem would be to > extend the existing wireshark decoders for PPP, which already know about > LCP negotiation and the existence of compressed data, so that they know > how to decode at least the freely-available compressed data formats. It > looks like a nice little project for someone. I suppose if I find a > whole bunch of time at some point, I might do it, but don't let that > stop anyone else from trying! --=_00a6429c2bee6501bcb78159a167098b Content-Transfer-Encoding: base64 Content-Type: application/zip; charset=binary; charset=UTF-8; name=packets.zip; Content-Disposition: attachment; filename=packets.zip; UEsDBBQDAAAIAHqHdEV0l2rGmAcAAK4PAAAMAAAAcGFja2V0cy5wY2FwhZd5VExxFMdvb95UqsmW NVFqZBcKxzptgxJDYYRkKdM2ZUuEMhIH2ddwjD3KHiLLZJyEkaXG3oJsodBpcRjjvTscHr8z5pz7 18z3+7n3+7vn/d4Uqk/upoCG3x8aZgCA+RB5QJ/X5jASAAtoqtHv35iDN4C7ZpAIRN3GZV62mOyT t7jTVReT5ZbgQCcCwHQ9D3QQSEVX19XzqVMMyD2e0rbIVjR+QOQa06wGD8tNwIIBlLjywAUAC+Af gL1wmghcujU4wZqzEPvFDAB4SSzAitGfb0NDXwAsgr6jMAT1B37psUEL1I9VOdSjwdx6e9Jp1ulA Wxr6A2ARRu2sEeGoeZxRrXBUmZ6ncrBgvFZQ8JT1yupsZnyqUOzqGGEqGavf0d0a+gBgEfTta9QA b03te8eM7tiJ1eerHWXqvMxn7C8kFA3JvQFYH/uef/jQ//oAMDOZJnxlPVgvR1m+mv2W8XousQFY 4QQgYHxu+ZsZ70eF/fT9q5/n2A9NH1+aZPApqTWHYQBYhH76a9wx47OcjFthxmG4TuOpd9/trO5d fG0duTfvWWP7oqZB9Bweel9TWRrPfDpmfpSQeRjqQwUwHACLoB8olKF+DWeTWqNeqoOhVNgN7Up+ F7fywFXS8Nl1tGdZ1VuTrgFB4TR2J5gvgLHs0pEnH6zxwMnTOZM74+ThOPkEqrb1oCXO+Utv5zR+ 45ucqE9pJT9e/CLBsaz4RaWHtLIhYrSLBDACAIuAGaTxRMxJDqYNYiIQM5GKCKKHF3XwLU2d1J1+ wx9soXJ9MEJ9tAXahy0RgIQ9U7K9SOOF9sc59vZoH4n2QVTEQNOjzq3GqNwuh5pLc2TpvIKMuJbZ oQDWjL9fIxPjZxiGZ5BBOMNIVp/SkwZ/ACyC3lMYjvrlnDN0RP04Hfhc0XrEf6mozFnNhFuhbJr6 Lr6s6eNOyXp9QjNFoMzQoqkbDWMAsAgRiDXeGMEhTgTtMIIojGAS5bzpdul102fpsvzYhNraYOe0 R8X8kqpP8cnq3LFWBkpZ75+DkCmeGjFhXRyRIkdKMFU7nlkXW3rLVC0d2fn6JbHW9XG03YezjYqi +YiIHU6DDwAWIau+wgjMai0nq5aYVaAOfK/s/1KdfetmSUZwppYfJr/hfldjXmCFzmmM8xAALIJz H2EkOq/jODdH5/E6GMY4a7MHyM9WKxz57qmLi1pkpJqgr1hCw2gALEIo3prBGEoaJxQhhhKNoUym nG9OLQ1dpZ6f6Xrkq7zq81nltHnv6f5Lb9EHXMSAkFQGgo8BMmSgZghCjnIgrRESg5ApVETgRjrf O/3uzHWlzBxzRamBr5XhFLo/+d/FEIXRpBEWPIbVz0u2gFEAWAS9h1CO+qWcaNuifoIO/KhlGTXx a1+NmCnLr/hWkjeaCjfLvLhk6ft0V2VuC8P8+QwhAACLQPASRiNBwSE4IWGiDoZTZwWnByU2S3Sa zKydWdl7D61XUD9V4Y3Egf7iusfJBkbs8j8Y9L8MzVDM+CAnYyfMeAZmPFUxDT4+zPoYUpipGf25 otKhmaRT+of2EwrclQdcDYxkJyuQAmARGEM0PsjYw2G0R8ZMZEyj5roPWnItl9+bHSWErx57/dtA 3j3Xx3w7m3Mhd2IbGThXelsZfx74Imcv4XkwCzkhDGfN4u1RsUekBf1ly7TWcXv6Wvpc2jvxzt1C 74ByCil34wXG9yYGT2U/YW9m1Gf025zBuH4G6vcR9LNYvbkvz3B9kfWDhTNRv4CzFc6oD9LBCNyK KVWVDlv0Kf39RVGe7vOyEiaZ6OKTI/X3YnKXZ51xABbj6cczvhjDMMx9hMWYjWGGKjbOKu0geLYy zbvpbZvgddX1CwOixyQdPBqtKqy2QMahVTzDKy15FHfhLBxlMWcUBxxlkg4k1MF6k2J2L1xn28Xt 0sQcWRtTn8bLeuVc/Nr6TdEpQMBXBuAHgEUADBDORkASB2CHgGAdjGSyWpijq7JcJHUzKbhaOCbA b4nLquVyWwrNF6z+T0J+hnUjJDQHE5qusFGX1lxUBxY6hbWpkVet2KS88kliO6GgvvJALSAjpQ3f OGM4MvYQGLHIkOFK2/asqWBmsLy23t/FL2GrKFWcrZw9hGdgrB5sanwh52BISsJCzmH1dyrNjOtj Ub+LoI9l9QlOlhDMJk7WS4RzUS/nHJIL6ifrYBQekl1R1be01kEnZvL3quWSJx/39NGoj53S6/Vq L/GTtU4lq88IzCKeNMB5bTpYGr+7RmCmSsLdNRczDVN4OWcpZktTWva0zi6JCjrdfKNpTYhqqvjm 5BfvIgEhxc2tjYcSh0PtJIQytwGjj5TShs0lNzlAIyE8l+2wyThsMlxRePh6aeCcJvcDmzzkR52z erDRvONmANb8zf+uvnnY3A5Cc3GsXnLIwvi73XzUxxHe7abowJ+afni0QFk26unKMT4lJpvveaiG bdLW1ds8ofgqtcG3LbbIP2wBXgBYBISrMB4RyRyEDSKm6iBAIQunI8pzDteTVrot8tLS6Nk24w9P +l9Pw18wM2tVGvRI0laYPiwHSVf/cY0qLoiLEhvAS4UfgImJuYVe/22F6MT7iT8AUEsDBBQDAAAI AKlzlkXn1bOCTgQAAKoEAAAPAAAAcGFja2V0cy5wcHBkdW1wPZN5MJRxGMefffddkatTx0at1KZT 06qmy5FUVJRN28YiR+tajURlHK2rCZVCpX+2lIyrmojG0K5tyBGxuxHWrmFKCLW5Jm/br9eMf5/n M9/P8zy/+VHAQksFArhY2PiUntOUcH/ty3RzJd323P6Q2zoVCzoGKfBQFIuBoZihh4Ou0aPEskul sRQw1lLFjPmochOD7kQZqqwmg85hQ39NDdqqvhmF5H7oXbxGacLDL1Nh21GUwSDgKBbYoEilbbEe 5KZxgiKm8IP9mu+UrWxeEA7FAShlI5nigU2a2SQwm5NaJIsHnJPjtemrBC97+uLW9vf0jdpzRhfC 2SgEm5OwJxbMw08oLZ3VOV7b8QHa4fliVruLtGQFVC9E0FoS4mHBB3RKmKvcxdbvAnQ5En4hVVZ0 ZWVlAIDlETTbegKcahT20dMjo5JbSDciMskZiu436dyUrNXGLRNy+QDTv1GcJRnnhTGzWtT1Or2F /ObIuMlJb2b+lx6aSvMzOllae8YAwGoPYteTrDc2eQ4tQ8fv+yrwkM311Y4KVmeY6Y/yRcowGmw+ huymBDjXPJser/zYqCryLlXQAgUNdq1NujIDUNmgPp2AY6ivqNwvKB8XrqXZ5VxXrijKoUCACdJs IDU+GLPRVx2QJr1Wyir+I9D8Khf5XR3G9yV9xPOsHAEe9iOUQaLnsWBuJt58qLA1PEONMqNsc7jf REEYHPk/zDoCjmMpRRPRd766hPObR2ZUH05jQfNKqxKShgtZotoVAFRvxDEJOIGVG5bZxC+Lt/BB q83rH7ZXOPD2iuUN8QfcHKc6kwGy2pGVSVp9hX4w1lEx5i8vbTr9a2SUscx1U+GPDR4yO1EeC2Dn Y0RuIkk/LMrOJqGulrbrf6w/TXqmfuYAtY3VSTNd8tb/U+QigCrjubfwR/Tt649CI4s5sn38FIXR lSd79J2qcz0/tcoPsQcxMPND024kwIWc9rxmlHFfm77PzTb0oN3VijgvChGdHKJtu1h7o+INA/Sq 5y4aIMy8pLY07E3NP2TSssQ7Y9xYzg5zT3xeEiaWj88Hdgxv9lqu2HM9r4uPYzwz6Fusqz0l/NU6 TotTdkqq/pgNKF8DLGIjzpyAk8gf4ykhNPoxPI41RfZe7s4+nmCVdkNAxyDYZe5QF4RLpOqJKilX bhG4ekKguZklqvnpSveQGYvyJgEmAudIPrk6fcfECMrTr7vrZnU87oFtjmOlKOIIFYCTh8QsAk7N ik2Vmpl8M96rcFquVODaNfZkd5P0xWutVit1cOy6Y6G69cZwXnDXAnCqmztBoNCBWSGM4KSv3GFU qQrllS3P1JnwF/s6Nvr0DYUAGC9F6BoSDRLKC+rV3MtLP3OXdtBC3xq0Z+puzAYYypj9Xm7YhYLT hqL+U92p7k4qSnabvfhYlmJKL9uj5z12z9kc9LsRuJwAtpAfhAcPSgr0OKPWMTwHBQ5PHWL/AVBL AwQUAwAACADVc5ZF/5xpl/8HAAAyFQAADgAAAHBwcGR1bXBfb3V0cHV0lFbXqhVBEHz3K8oAImoz szvpYM6YH4yYJ/RgQsEcfl5rnOsVMTb3LnsOu7XVVdW957W+eAP0DrPCGPTGo88wC0JH9+gJZgOX eZIWrA01AMK6Iy9F5ILIEdmBUcUgNSwLWoMtcAa+8JZQkTpMQEmwBi1BM4wlzi6R43ePPJdRE4cc /q9kx6v6rgHVYLEkbBxBTIJRbAqSQ/G/vHGnbD36RykmTt7GSdSE563+hCC/wdiWs/BWLegK22Aq 2oLSoJHsQp1y3pWtej5lyCtqglrYFYsZogZ4Jano5yN+5iIQeSBvZSoyKbjNcHSDmtE8UoHxWBpW D830O1X4hJCJcV6eEOig/+rw7aeTS3QjCg5uhTr0r8cNLVwU3pFU2BJr1huRU8K6/uDpb5WppNUj rGLtSCuWiKpIHrWj2qnMva//x2TvdkAoiCa4ghSQDGFTg60Iygw2ha6IHcvg2pQ4F4X1gofdWzi8 TDvcAp94Yu3foidy8vbvjW5D5TI9ckrLlg15qsEmz3buy7MHckX2XfxOw3eslrdoojEuwmRmcHVo Ea6jrsgKu9mi99CKyDkRJ1f/kDuddFaFCQRYIkXyYWD7SeeBPDsqX9W9KX5rjDtCYOh9ogkhIRci txW5IibYjFLGNWYwki635THBPoj0n7OXURc0T5ljQd9AFTrsTbptnSowtsnJz7JVW3NgYAP100IE dfzYMhb6T4Te6baN3FB+ykyU/TLqzsQJaRL+13r8W2k7zEI5N0wq3a0baqyWUoU0pX3I0I56PClU RQwk2yP/giFITmgbNKX3rXO2ukUczUHeicijATOa2sJZuYd9hKn/1pPIrd8GJZg5hr5sj6EtDOQm Iqyzm0cid7+NYZ0smuc1oWKpFKAoXOCXzG1G6Fx32lAiLN8JxHl+QOSsOHn5g8G80vj/Meblzxkr zFj2TFf3DGdtqIVq5sr+ihtk/fdNMDvaprBBUK5HZ9EsamX+2zr1/UU9eSEniPEzk7rNpA0mayNy iSSWFu4kjrglk0vCOvJi7KQTk8kmI9mx7DfIlR/Nn9fSn98+wc6o1kIr1XBuU2WCYqYuEFb+amzl 7H6aitDE3NAL2TOSC3vIBsEhbqCV1q917OrGc7i5XttHkcM/TG/AauDCP8+emLO/bWbZ2rAZG8en VoXzyIWmxWU2U+TZHRE5I/JqS1QLNdtuxAjHjUwc/dbV1vt91vDl/XH5ivP0Z4vHmk+R7vTAQd0Y aIDrZBASOamiV6Jcnrvo6qvH25K0jprgPXH44EgfSuPkJU9pcxnyGw653RDnBmmMcts4U9F/r587 UZhhq2kofsy+gY08Lg7Bbg84RK7IeA2L7MnbP1FMhDoydt9WvINXrAXVoDnUTKhV4VcGoKeh60k5 /eAQwY5eO/tdkYwU/qefPwR+5ZgFN7750oqVtkYRBNG/Uojg8aGYvntERPFAPPCKEsSDPo0Xiucn /e3OK3t3zYYlCTiEZMkkM131Xr33uiVs5ogP3mFJa8IXrvKz8VpTCyDpeviTVmiFm2AzKUPHdCRX IApWARvipxL+Hi42c/4FX/uX8PZUtdidtVgABLaqocwlgBPTAlYgvwpIlX9eAzIc0rYye1G9YuAV ZQYpTRMv10Oll7vqrzI38YgrhximLOVZWjfBuJQ+ri409MdubNymntgpKoRzX/HoVBE3aGDyE9r6 8Qfvr+ox0BofMXaorSGGpKWGpYCMiJEb4rKrWGhFXy4fSBy5hEjxcjN5FnLhLLUx78dic3PviMT3 7anxmroZnJnDyDRGpuaBTE0GTxZVHKvAOEyo2wqXwgyKhi6xQuEtYv6Ar3cgRU+ufrx+bZHV19CS D+tqgghEFIZnT/rY+PqZwdhd4HiKGrIaxCb0jAKbopiRUOzIi/CIr3yBoa8rkniEIGVhtLOCz00d nXYWzu48tl8pIID6DmWgYb289+nZ8v3TBhz533TywdmGxiHJ4F3TTK6jP0lRqFiVymPDkxs5IfxD JLTP/Eu2Oi9lDTTyrsJuFbRSBowzHr/P4oaqUYuw5yytIz6Q1Or5P21hRyFqzTGsvwgrugHZQ8Og GAeqVMlmj5hRBfPvfbdRMysQeKBgYS1w4VjAFt/QjW36Mz/bu88TTHzn+CJhA+giDOkePYG2JLxL r6T1DY/czWfX6Qot7X5kiZhodmJvmroCaioPaZ26SOvbkSWA0otDWaKH/2QTcUuKsAZjsMjWNlJ0 wCJFhldSNDo/ZUjxrMlJY23F/M5xxArrKWcUEiyRw3OeTPeZr/It5m/jOTZiPaeo5fYRtuttkqhK VXjSC2ZWNdhxFpt4PEiC69VaQDT0PxmA6BuAqBleCWWNVCQlpg6q944v+oI9NAYnHmJ7ly2qtZL/ JQ9pi5QTG3RpqsgJPuOWGjtGvrG04izjer8boxl8sxbxNUd8DhbQYMeYFrAGRm/5xrmlr/vMZjV9 jbKkf1+lA45UlMDohYQOKuQlk5S8stGPr4b3lFuc/jkfyOTLSWGCje4sJqGAaiklOHGTc7bgSDmq fr1tHTHv+ffNthV/EIGTrzBjnB8FKSaSTjQfjU0ohnFdPMIYI5EzYA2InxUcbRZMqgVC70T1asdD nvAbJBww59mdta4pvLFqshpNtAWTXMc5IW5hjBsVCS6zGYHv3jjH2TDGZtL6NCp598xWKVZiXhwH Tz7D0otCZdM8znOMg1oS8x4fvBOe8T6736sl2BGTTrqKG1j+H1BLAQI/AxQDAAAIAHqHdEV0l2rG mAcAAK4PAAAMAAAAAAAAAAAAIICkgQAAAABwYWNrZXRzLnBjYXBQSwECPwMUAwAACACpc5ZF59Wz gk4EAACqBAAADwAAAAAAAAAAACCApIHCBwAAcGFja2V0cy5wcHBkdW1wUEsBAj8DFAMAAAgA1XOW Rf+caZf/BwAAMhUAAA4AAAAAAAAAAAAggKSBPQwAAHBwcGR1bXBfb3V0cHV0UEsFBgAAAAADAAMA swAAAGgUAAAAAA== --=_00a6429c2bee6501bcb78159a167098b--