PPPoed capture on PIX

[tschimmel]

I've looked all over the Cisco site to find out what this actual capture pppoed output I collected actually means. Any help? I can guess, I just need detail. Tried importing to ethereal with no luck.

13:19:08.924970 0002.b309.95cb 000e.a619.1502 0x0800 1434: 208.218.128.231.80 >

10.145.10.203.1127: . 2473143978:2473145358(1380) ack 3662812289 win 6930 (DF) (

ttl 62, id 63664)

13:19:08.925565 00d0.bcf2.701c 0002.b309.95cb 0x0800 60: 10.145.10.203.1127 > 20

8.218.128.231.80: . [tcp sum ok] 3662812289:3662812289(0) ack 2473145358 win 655

35 (DF) (ttl 127, id 15997)

13:19:08.932492 0002.b309.95cb 000e.a619.1502 0x0800 1434: 208.218.128.231.80 >

10.145.10.203.1127: . 2473145358:2473146738(1380) ack 3662812289 win 6930 (DF) (

ttl 62, id 63665)

[mmorris11]

Just looks like ordinary network traffic to me. I don't see anything "pppoe" about that trace.

[tschimmel]

Yes, I just want a decriptor for each thing. Not the IP's of course.

[mmorris11]

Ok, I'll take a stab at it:

13:19:08.924970 - Really long timestamp

0002.b309.95cb 000e.a619.1502 - Source and destination mac addresses

0x0800 1434: - not sure

208.218.128.231.80 > - Source IP and port

10.145.10.203.1127: - Destination IP and port

. 2473143978:2473145358(1380) - MSS (Maximum Segment Size) I think

ack 3662812289 win 6930 - TCP ack # and window size

(DF) - "Do not fragment" bit is set

(ttl 62, id 63664) - Time to Live and some id #

HTH pls rate!