sorry - should have used the term OFFSET. My problem was different, for some reason i switched between src and dst mac, and indeed it is 22bytes from src ( as it should ).
Thanks for the help... Eddie. On Wed, Apr 15, 2009 at 2:48 PM, Guy Harris <g...@alum.mit.edu> wrote: > > On Apr 15, 2009, at 11:19 AM, Eddie Harari wrote: > > how come 22 bytes offset with no Qos ? >> in the case both are not set (TO DS and From DS ) then Address 1 is >> destination , adress 2 is source and address 3 is bssid , so there are >> 18bytes of addresses, >> > > There are 18 bytes of address, *but* when I read "the gap between the > destination address and the IP header", I interpret that as "the gap between > the *end* of the destination address and the beginning of the IP header", so > that would be *12* bytes of address (address 2 and address 3), 2 bytes of > sequence control, and 8 bytes of 802.2 and SNAP, i.e. 22 bytes. > > > - > This is the tcpdump-workers list. > Visit https://cod.sandelman.ca/ to unsubscribe. > - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
