diff options
| author | guy <guy@f5534014-38df-0310-8fa8-9805f1628bb7> | 2007-11-21 22:16:04 +0000 |
|---|---|---|
| committer | guy <guy@f5534014-38df-0310-8fa8-9805f1628bb7> | 2007-11-21 22:16:04 +0000 |
| commit | 63a17517e6a769237da49f1ef50f4936cbd1d0ef (patch) | |
| tree | ee66a2e9f89d90c4581c4d245024d10544a9a280 /wiretap/visual.c | |
| parent | ecf28cd20c13e68ae4987250b06fbd54408602ad (diff) | |
Don't use "if it begins with 0xff 0x03 it's PPP, otherwise it's Cisco
HDLC" to try to distinguish Cisco HDLC from PPP packets;
Address-and-Control-Field-Compression can be negotiated on, so there's
no guarantee that PPP frames begin with 0xff 0x03. Fixes bug 2005.
git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@23535 f5534014-38df-0310-8fa8-9805f1628bb7
Diffstat (limited to 'wiretap/visual.c')
| -rw-r--r-- | wiretap/visual.c | 13 |
1 files changed, 3 insertions, 10 deletions
diff --git a/wiretap/visual.c b/wiretap/visual.c index a4d4f67395..2f495c5c77 100644 --- a/wiretap/visual.c +++ b/wiretap/visual.c @@ -430,16 +430,9 @@ static gboolean visual_read(wtap *wth, int *err, gchar **err_info, /* Fill in the encapsulation. Visual files have a media type in the file header and an encapsulation type in each packet header. Files with a media type of HDLC can be either Cisco EtherType or PPP. */ - if (wth->file_encap == WTAP_ENCAP_CHDLC_WITH_PHDR) - { - /* examine first two octets to verify encapsulation */ - buf = buffer_start_ptr(wth->frame_buffer); - if ((0xff == buf[0]) && (0x03 == buf[1])) - { - /* It is actually PPP */ - wth->phdr.pkt_encap = WTAP_ENCAP_PPP_WITH_PHDR; - } - } + if ((wth->file_encap == WTAP_ENCAP_CHDLC_WITH_PHDR) && (vpkt_hdr.encap_hint == 14)) + wth->phdr.pkt_encap = WTAP_ENCAP_PPP_WITH_PHDR; + return TRUE; } |