Re: [Wireshark-dev] Dissector for link layer to run before ethernet one

On Jul 20, 2017, at 4:47 AM, Mihai Cîrîc via Wireshark-dev wrote: > I have some capture files with packets encapsulated under ethernet. But > these packets have a short header before the mac addresses So you have 1) a header prepended before the Ethernet

Re: [Wireshark-dev] Dissector for link layer to run before ethernet one

If the header is always identifiable easily, you could write a heuristic dissector for "frame" and work from there. cheers Roland On Thu, Jul 20, 2017 at 1:47 PM, Mihai Cîrîc via Wireshark-dev < wireshark-dev@wireshark.org> wrote: > Hello all, > > I have some capture files with packets

Re: [Wireshark-dev] Dissector for link layer to run before ethernet one

On Thu, Jul 20, 2017 at 7:47 AM, Mihai Cîrîc via Wireshark-dev < wireshark-dev@wireshark.org> wrote: > Hello all, > > I have some capture files with packets encapsulated under ethernet. But > these packets have a short header before the mac addresses and I am > trying to write a dissector that

[Wireshark-dev] Dissector for link layer to run before ethernet one

Hello all, I have some capture files with packets encapsulated under ethernet. Butthese packets have a short header before the mac addresses and I amtrying to write a dissector that would run before the ethernet one,parse the header and then call the ethernet dissector to continue parsingthe