On Sun, 25 Jul 1999 09:09:49 +0900 
 itojun@iijlab.net wrote:

 > 	The source of problem is that bpf link layer encapsulation type
 > 	code is changed from DLT_PPP to DLT_NULL, in sys/net/if_ppp.c,
 > 	between 1.51 and 1.52.

Actually, if you look a little more carefully, you'll see that in
ppp_tty.c:

#if NBPFILTER > 0
	/* Switch DLT to PPP-over-serial. */
	bpf_change_type(&sc->sc_bpf, DLT_PPP_SERIAL, PPP_HDRLEN);
#endif

The point is to make it not dependent on the encapsulation of
PPP over serial.  For example, PPP over Ethernet and PPP over ATM
do not use the address and control bytes (the "ff 03").  They start
directly with the ppptype (PPP_IP, PPP_IPX, PPP_LCP, etc.)

...if you take a look at tcpdump's print-ppp.c, there is special
handling for the NetBSD PPP DLTs, just like in the BSD/OS case.

Hm, looks like IPv6 support is missing from the ppp_netbsd_common_print()
function :-)

I think I missed part of this thread... what exactly is the problem
being observed?  I did these changes, and will be more than happy to
help sort out a fix.

 > 	protocol type.  Now, libpcap checks ppp encapsulation part to check
 > 	if it is IPv4 or IPv6, and now the problem becomes apparent.

        -- Jason R. Thorpe <thorpej@nas.nasa.gov>