[Winpcap-users] sending over slip
gianluca.varenni at cacetech.com
Tue Jun 10 18:48:54 GMT 2008
----- Original Message -----
From: "Guy Harris" <guy at alum.mit.edu>
To: <winpcap-users at winpcap.org>
Sent: Monday, June 09, 2008 6:16 PM
Subject: Re: [Winpcap-users] sending over slip
> On Jun 9, 2008, at 1:14 PM, AmenophisIII wrote:
>> since im not using "normal" ppp, but slip
> SLIP? Wow. Now *that's* a blast from the past....
>> i was wondering if thats
>> exactly the same cause.
> Probably. I suspect SLIP plugs into the Windows networking stack the
> same way that PPP does, i.e. through NDISWAN:
> or something like it. That's the part of the OS that translates incoming
> PPP - and probably SLIP - frames into fake Ethernet frames before handing
> them to the Windows networking stack, and transforms outgoing Ethernet
> frames being sent over a PPP - or probably SLIP - connection into PPP or
> SLIP frames before handing them to the WAN miniport driver.
> I'm not certain why it's not possible to transmit on a PPP/WAN
> connection, but I suspect that whatever the reason is also applies to
> SLIP/WAN connections.
The reason is because in order to capture from PPP/WAN connections, we use
the Microsoft NetMon component, which does not support transmission.
>> i do see ethernet frames when capturing with wireshark too, although
>> slip doesnt use ethernet, so im quite sure...
>> if its the same... i guess it wont change (ever), correct?
> Probably not, unless there's some way in which a driver can put itself on
> the "other side" of NDISWAN. I'm not sure there is any way for a
> non-Microsoft driver (such as the WinPcap driver) to do that.
No idea either. NDISWAN is a sort of "black hole". The documentation is at
most sparse, inaccurate and not complete. In practice, it's completely
Have a nice day
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
More information about the Winpcap-users