<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE></TITLE>
<META content="MSHTML 6.00.6000.16705" name=GENERATOR>
<META http-equiv=Content-Type content="text/html; charset=GB2312">
<STYLE></STYLE>
</HEAD>
<BODY style="FONT-SIZE: 8pt; FONT-FAMILY: Tahoma" bgColor=#ffffff leftMargin=5
topMargin=5 #ffffff>
<DIV><FONT face="Courier New" size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=melcug@gmail.com href="mailto:melcug@gmail.com">Gogu Melcu</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Saturday, August 16, 2008 11:45
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] Strange behavior
on capturing PPPoE pachets</DIV>
<DIV><FONT face="Courier New" size=2></FONT><BR></DIV>
<DIV><FONT size=2>I am using Wireshark to debug capturing process of
PPPoE packets.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Why </FONT><FONT size=2>PPPoE packets are captured on
"NVIDIA nForce Networking Controller" interface and not on "WAN
(PPP/SLIP) Interface"?</FONT></DIV>
<DIV><FONT face="Courier New" size=2></FONT> </DIV></BLOCKQUOTE>
<DIV><FONT face="Courier New" size=2>Because PPPoE packets go out of an ethernet
interface. You will basically see the packets going out of the WAN interface,
then the WAN driver encapsulates them in PPPoE ethernet frames and sends them to
the ethernet interface connected to your DSL modem.</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV><FONT face="Courier New" size=2></FONT> </DIV>
<DIV><FONT face="Courier New" size=2></FONT> </DIV>
<DIV><FONT size=2>Why some packets are captured twice, first on "WAN
(PPP/SLIP) Interface" and second on "GenericDialupAdapter"?</FONT></DIV>
<DIV><FONT face="Courier New" size=2></FONT> </DIV>
<DIV><FONT face="Courier New" size=2></FONT> </DIV></BLOCKQUOTE>
<DIV><FONT face="Courier New" size=2>This is normal. GenericDialupAdapter is aa
fake adapter that receives all the packets coming from dialup/VPN connections
(including PPPoE).</FONT></DIV>
<DIV><FONT face="Courier New" size=2></FONT> </DIV>
<DIV><FONT face="Courier New" size=2>Have a nice day</FONT></DIV>
<DIV><FONT face="Courier New" size=2>GV</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV><FONT face="Courier New" size=2></FONT> </DIV>
<DIV><FONT face="Courier New" size=2></FONT> </DIV>
<DIV>Open device: \Device\NPF_GenericDialupAdapter 0.0.0.0 0.0.0.0<BR>Open
device: \Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7} 79.118.219.97
255.255.255.255 (<FONT size=2>WAN (PPP/SLIP) Interface)</FONT><BR>Open device:
\Device\NPF_{B949492E-4290-4D4A-AA05-D2F8AB7FA4EA} 192.168.1.64
255.255.255.0<BR>Packet: 79.118.219.97:1574 169.254.119.251:2869 TCP 66
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet:
79.118.219.97:1574 169.254.119.251:2869 TCP 66
\Device\NPF_GenericDialupAdapter<BR>Packet: 79.118.219.97:1575 91.195.7.1:80
TCP 66 \Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet:
79.118.219.97:1575 91.195.7.1:80 TCP 66
\Device\NPF_GenericDialupAdapter<BR>Packet: 91.195.7.1:80 79.118.219.97:1575
TCP 66 \Device\NPF_GenericDialupAdapter<BR>Packet: 79.118.219.97:1575
91.195.7.1:80 TCP 54 \Device\NPF_GenericDialupAdapter<BR>Packet: 91.195.7.1:80
79.118.219.97:1575 TCP 66
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet:
79.118.219.97:1575 91.195.7.1:80 TCP 54
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet:
79.118.219.97:1576 210.51.25.206:80 TCP 66
\Device\NPF_GenericDialupAdapter<BR>Packet: 79.118.219.97:1577
89.111.182.80:80 TCP 66 \Device\NPF_GenericDialupAdapter<BR>Packet:
89.111.182.80:80 79.118.219.97:1577 TCP 66
\Device\NPF_GenericDialupAdapter<BR>Packet: 79.118.219.97:1577
89.111.182.80:80 TCP 54 \Device\NPF_GenericDialupAdapter<BR>Packet:
210.51.25.206:80 79.118.219.97:1576 TCP 66
\Device\NPF_GenericDialupAdapter<BR>Packet: 79.118.219.97:1576
210.51.25.206:80 TCP 54 \Device\NPF_GenericDialupAdapter<BR>Packet:
79.118.219.97:1576 210.51.25.206:80 TCP 66
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet:
79.118.219.97:1577 89.111.182.80:80 TCP 66
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet: 89.111.182.80:80
79.118.219.97:1577 TCP 66
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet:
79.118.219.97:1577 89.111.182.80:80 TCP 54
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet: 210.51.25.206:80
79.118.219.97:1576 TCP 66
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet:
79.118.219.97:1576 210.51.25.206:80 TCP 54
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet:
79.118.219.97:1578 72.232.199.165:80 TCP 66
\Device\NPF_GenericDialupAdapter<BR>Packet: 79.118.219.97:1578
72.232.199.165:80 TCP 66
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet:
72.232.199.165:80 79.118.219.97:1578 TCP 66
\Device\NPF_GenericDialupAdapter<BR>Packet: 79.118.219.97:1578
72.232.199.165:80 TCP 54 \Device\NPF_GenericDialupAdapter<BR>Packet:
72.232.199.165:80 79.118.219.97:1578 TCP 66
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet:
79.118.219.97:1578 72.232.199.165:80 TCP 54
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet: 91.195.7.1:80
79.118.219.97:1575 TCP 66 \Device\NPF_GenericDialupAdapter<BR>Packet:
79.118.219.97:1575 91.195.7.1:80 TCP 54
\Device\NPF_GenericDialupAdapter<BR>Packet: 91.195.7.1:80 79.118.219.97:1575
TCP 66 \Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet:
79.118.219.97:1575 91.195.7.1:80 TCP 54
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet:
72.232.199.165:80 79.118.219.97:1578 TCP 66
\Device\NPF_GenericDialupAdapter<BR>Packet: 79.118.219.97:1578
72.232.199.165:80 TCP 54 \Device\NPF_GenericDialupAdapter<BR>Packet:
72.232.199.165:80 79.118.219.97:1578 TCP 66
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet:
79.118.219.97:1578 72.232.199.165:80 TCP 54
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet: 91.195.7.1:80
79.118.219.97:1575 TCP 66 \Device\NPF_GenericDialupAdapter<BR>Packet:
79.118.219.97:1575 91.195.7.1:80 TCP 54
\Device\NPF_GenericDialupAdapter<BR>Packet: 91.195.7.1:80 79.118.219.97:1575
TCP 66 \Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet:
79.118.219.97:1575 91.195.7.1:80 TCP 54
\Device\NPF_{655ED554-F705-4264-9DBC-B2C204A1EDC7}<BR>Packet:
72.232.199.165:80 79.118.219.97:1578 TCP 66
\Device\NPF_GenericDialupAdapter<BR>Packet: 79.118.219.97:1578
72.232.199.165:80 TCP 54 \Device\NPF_GenericDialupAdapter</DIV>
<DIV> </DIV>
<DIV><FONT size=2>Thanks for this very usefull library.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Gogu Melcu<!--AID_FROMNAME_END-->, </FONT><A
href="mailto:<!--AID_FROMADDRESS_BEGIN-->melcug@gmail.com<!--AID_FROMADDRESS_END-->"><!--AID_FROMADDRESS_BEGIN--><FONT
size=2>melcug@gmail.com<!--AID_FROMADDRESS_END--></FONT></A></DIV>
<DIV><FONT size=2>16-08-2008</FONT></DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>