john_walker2020@yahoo.com (John Walker) writes:
> My situation is I have a IM driver right between the PPP protocol
> driver and the WAN miniport driver. In this case it happens to be on
> WinCE.

The above is just plain greek to me. No clue what you're saying.

> I can see the traffic come in and out but I am new to PPP. And from
> my research it looks like the PPP packets are HDLC. I'm not sure yet
> what this really means.

PPP uses HDLC-like framing. This means that PPP reuses the same basic
framing formats, error detection, and header fields, but doesn't use
the rest of HDLC -- it doesn't use the 7 bit encoding mechanism, nor
(at least by default) any of the various reliability schemes (such as
LAP-B).

> What I do know is that I can see the start sequence, 0x7E. And I try
> to capture the known fields afterwards (control, protocl, etc) - but
> they seem invalid.

If you're seeing 7E, then this is either octet synchronous PPP (used
only on SONET/SDH) or (very much more likely) AHDLC. See RFC 1662:

ftp://ftp.isi.edu/in-notes/rfc1662.txt

And, of course, the actual exchanges are described in RFC 1661, as
well as a number of other RFCs that are specific to what you're trying
to do with the link (likely, you need RFCs 1332 and 1334, but that's
just a guess).

I can recommand a book on this if you're interested.

> Is there something I'm missing?

Well, for one thing, you haven't actually given any debug output or
other details, so it's hard to say what the problem might be.

--
James Carlson, IP Systems Group
Sun Microsystems / 1 Network Drive 71.234W Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757 42.497N Fax +1 781 442 1677

In article ,
John Walker wrote:
>Hello all,
>
> I am writing to ask all the PPP gurus to help assist me in
>understanding the PPP protocol and Simple HDLC PPP protocol.
>
>My situation is I have a IM driver right between the PPP protocol
>driver and the WAN miniport driver. In this case it happens to be on
>WinCE.

Interesting... I've never had any luck getting an intermediate driver
at that level. Any hints on how you did that?

>I can see the traffic come in and out but I am new to PPP. And from
>my research it looks like the PPP packets are HDLC. I'm not sure yet
>what this really means.
>
>What I do know is that I can see the start sequence, 0x7E. And I try
>to capture the known fields afterwards (control, protocl, etc) - but
>they seem invalid.
>
>Is there something I'm missing?

Why don't you dump a bunch of the bytes your seeing (it would be best
to show all the bytes in sequence seperated by channel only)? I bet
it'll start to make sense once you see how simple it really is.

Patrick
========= For LAN/WAN Protocol Analysis, check out PacketView Pro! =========
Patrick Klos Email: patrick@klos.com
Klos Technologies, Inc. Web: http://www.klos.com/
==================== What goes around, comes around... =====================