> Notice that the way to decide that this is an ISL encapsulated packet
> (as far as I can see) is that:
>
> - it has an Ethernet length field (not type)
> - it has SSAP = DSAP = 0xaa
> - it has a multicast destination, 01:00:0c:00:00:00 (actually only 40
> bits are fixed, this is not incorporated in the current patch)
Ethereal does almost the same check, except it doesn't bother checking
the SSAP and DSAP (and it checks only the first 40 bits); is it always
the case that ISL packets have SNAP as the SSAP and DSAP?
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
