The Care and Feeding of ISDN4BSD
10.4.2 sppp Problems	10.4 Troubleshooting the PPP	11 Setting up an

10.4.3 Using tcpdump

FreeBSD 3.0 and upward now have support built into tcpdump to decode and pretty-print PPP packets. The contrib directory of the i4b ftp distribution kit contains a new version of this PPP pretty printer for the tcpdump utility. To be able to use it, you have to replace tcpdump's ppp-print.c and recompile tcpdump.

A prerequisite for using tcpdump is that your kernel config file must have a line similar to this one for FreeBSD 3.x:

pseudo-device bpfilter 4

or this one for FreeBSD 4.0 and higher:

pseudo-device bpf 4

which adds Berkeley Packet Filter support to your kernel. For more information on Berkeley Packet Filter and tcpdump see the manual pages bpf(4) and tcpdump(1).

Given that everything is setup as described, you are now able to start tcpdump to listen on our example interface isp0, use the command:

tcpdump -iisp0

to start tcpdump listening on interface isp0. The output of tcpdump for our example setup will look like this one:

tcpdump: listening on isp0

ID-045 LCP: Configure-Request, Magic-Number=1713843488

                         012d 000a 0506 6627 2d20

ID-005 LCP: Configure-Request, Auth-Prot CHAP/MD5, Magic-Number=1862667504

                         0105 000f 0305 c223 0505 066f 060c f0

ID-005 LCP: Configure-Ack, Auth-Prot CHAP/MD5, Magic-Number=1862667504

                         0205 000f 0305 c223 0505 066f 060c f0

ID-045 LCP: Configure-Ack, Magic-Number=1713843488

                         022d 000a 0506 6627 2d20

ID-003 CHAP: Challenge, Value=6f060cf9e3d463d8ef2d917f323e488a, Name=c_xxx

                         0103 001a 106f 060c f9e3 d463 d8ef 2d91

                         7f32 3e48 8a63 5f68 6373

ID-003 CHAP: Response, Value=ad02296cb6fcd499c24b78f30f0ede3b, Name=hmbsd

                         0203 001a 10ad 0229 6cb6 fcd4 99c2 4b78

                         f30f 0ede 3b68 6d62 7364

ID-003 CHAP: Success

                         0303 0004

ID-046 IPCP: IP-Address=0.0.0.0

                         012e 000a 0306 0000 0000

ID-003 IPCP: IP-Address=192.76.124.10

                         0103 000a 0306 c04c 7c0a

ID-003 IPCP: IP-Address=192.76.124.10

                         0203 000a 0306 c04c 7c0a

ID-003 8207:

                         0103 0004

ID-047 LCP: Protocol-Reject

                         082f 000a 8207 0103 0004

ID-046 IPCP: IP-Address=192.168.168.168

                         032e 000a 0306 c0a8 a8a8

ID-048 IPCP: IP-Address=192.168.168.168

                         0130 000a 0306 c0a8 a8a8

ID-048 IPCP: IP-Address=192.168.168.168

                         0230 000a 0306 c0a8 a8a8

ID-001 LCP: Echo-Request, Magic-Number=1862667504

                         0901 000c 6f06 0cf0 7c0a 0000

ID-001 LCP: Echo-Reply, Magic-Number=1713843488

                         0a01 000c 6627 2d20 7c0a 0000