[Winpcap-users] sending over slip

[Guy Harris]

On Jun 9, 2008, at 1:14 PM, AmenophisIII wrote:

> since im not using "normal" ppp, but slip

SLIP?  Wow.  Now *that's* a blast from the past....

> i was wondering if thats
> exactly the same cause.

Probably.  I suspect SLIP plugs into the Windows networking stack the  
same way that PPP does, i.e. through NDISWAN:

	http://msdn.microsoft.com/en-us/library/ms798376.aspx

or something like it.  That's the part of the OS that translates  
incoming PPP - and probably SLIP - frames into fake Ethernet frames  
before handing them to the Windows networking stack, and transforms  
outgoing Ethernet frames being sent over a PPP - or probably SLIP -  
connection into PPP or SLIP frames before handing them to the WAN  
miniport driver.

I'm not certain why it's not possible to transmit on a PPP/WAN  
connection, but I suspect that whatever the reason is also applies to  
SLIP/WAN connections.

> i do see ethernet frames when capturing with wireshark too, although
> slip doesnt use ethernet, so im quite sure...
> if its the same...  i guess it wont change (ever), correct?

Probably not, unless there's some way in which a driver can put itself  
on the "other side" of NDISWAN.  I'm not sure there is any way for a  
non-Microsoft driver (such as the WinPcap driver) to do that.