Read PPP Record Files Safely with pppdump

pppdump turns a raw PPP capture into text you can actually read, byte by byte or packet by packet, whichever the fault you are chasing needs. The installed command is pppdump from the Ubuntu ppp package, version 2.4.9-1+1.1ubuntu4. Ten minutes if the record file is already sitting there waiting. It only reads and decodes; it never starts or stops a PPP connection.

Prerequisite: a readable file that pppd created with its record option, plus enough free space for the text output. Reading something in your home directory is normally unprivileged. Reach for elevated privileges only if the file's permissions actually require it, and copy the evidence into a working directory of your own first.

1. Check the installed command and source file

Confirm which binary will actually run, and inspect the record without touching it:

$ command -v pppdump
/usr/sbin/pppdump
$ test -r /path/to/ppp-record && echo 'record is readable'
record is readable
$ pppdump -h /path/to/ppp-record

That last command prints hexadecimal bytes and decoded directions straight to standard output; it writes no report file unless you redirect it. pppdump takes one or more filenames, or reads standard input if you give it none.

$ sudo install -o "$USER" -g "$(id -gn)" -m 0600 /path/to/ppp-record ./ppp-record.copy
$ test -r ./ppp-record.copy && echo 'working copy is readable'
working copy is readable

2. Produce a first report without destroying an old one

Shell redirection with > truncates its destination before pppdump ever runs, which is how people lose yesterday's report. Pick a new name, or write to a temporary file and rename it only once the command has actually succeeded:

$ pppdump -h ./ppp-record.copy > ./ppp-record.hex.new
$ test "$?" -eq 0
$ test -s ./ppp-record.hex.new && echo 'hex report is non-empty'
hex report is non-empty
$ mv ./ppp-record.hex.new ./ppp-record.hex

mv renames within the same filesystem and is normally unprivileged. If the decode fails, leave the previous report untouched and go read the error instead. Remove the incomplete .new file only after checking its path: deletion has no undo in pppdump.

For a quick look in the terminal, skip the redirection entirely:

$ pppdump -h ./ppp-record.copy | less

Do not paste a full capture into a shared terminal or ticket if it might contain credentials, authentication exchanges, addresses or application data.

3. Pick the output that answers your question

Left with no -h or -p, the default prints bytes as characters where it can and falls back to escape sequences for anything non-printing or non-ASCII. Good choice when the record holds readable protocol text:

$ pppdump ./ppp-record.copy > ./ppp-record.text

Reach for -h when the byte values themselves matter. Often the clearest first pass for control characters and binary payloads:

$ pppdump -h ./ppp-record.copy > ./ppp-record.hex

-p collects bytes into PPP packets: it interprets asynchronous HDLC framing and escape characters, checks each packet's FCS, and prints packet bytes as both hexadecimal and characters, with a dot standing in for anything non-printing:

$ pppdump -p ./ppp-record.copy > ./ppp-record.packets

Reach for packet mode when you need packet boundaries or framing and FCS checks. It is not just a prettier hex dump, so do not compare its line layout directly against a default character report; the two are answering different questions.

4. Handle compression and direction labels

Compressed with BSD-Compress or Deflate? Add -d to -p, shortened to -pd:

$ pppdump -pd ./ppp-record.copy > ./ppp-record.decompressed

The decompression switch only means something alongside packet collection. If the output comes out unreadable anyway, repeat the command without -d first and compare: not every opaque payload is compressed PPP data.

-r reverses the direction indicators in the record when they need it. This swaps labels only: anything marked received is printed as sent, and vice versa.

$ pppdump -pr ./ppp-record.copy > ./ppp-record.reversed

Only reach for it once you have established that the recording endpoint's perspective is the opposite of what you need. Reversing labels does not reverse packet bytes, and it will not repair a malformed capture either.

5. Make timestamps and MRU checks explicit

-a prints absolute times instead of the ordinary presentation. Worth adding when you are lining the report up against logs from another machine:

$ pppdump -pa ./ppp-record.copy > ./ppp-record.absolute

In packet mode, -m sets the maximum receive unit used for over-length checks in both directions. Give it a numeric value that actually fits the link:

$ pppdump -p -m 1500 ./ppp-record.copy > ./ppp-record.mru1500

Do not treat 1500 as a universal default; it is an example value here, not a measurement of your connection. Check the negotiated or configured link settings before an MRU-specific report goes anywhere near an incident record.

6. Read from standard input and verify a batch

When another tool has already picked the record out, pipe it straight to pppdump without a filename:

$ find ./captures -maxdepth 1 -type f -name '*.ppp' -print0 \
    | xargs -0 pppdump -p

That sends multiple filenames into one invocation. For a single stream, the simpler form does the job:

$ cat ./ppp-record.copy | pppdump -p > ./ppp-record.stdin

In a script, check the exit status straight away and keep the source file regardless:

if pppdump -p ./ppp-record.copy > ./ppp-record.packets.new; then
    mv ./ppp-record.packets.new ./ppp-record.packets
else
    status=$?
    printf 'pppdump failed with status %s\n' "$status" >&2
    exit "$status"
fi

An input error means checking that the file is readable and actually is a PPP record from the matching capture workflow: an arbitrary pcap, text log or modem trace is not interchangeable with a pppd record file. Keep the raw record until the report has been checked; the report is a derived view, not a replacement for the evidence.