> Ethereal does almost the same check, except it doesn't bother checking > the SSAP and DSAP (and it checks only the first 40 bits); is it always > the case that ISL packets have SNAP as the SSAP and DSAP? According to the Cisco URL I mentioned, yes. Steinar Haug, Nethelp consulting, [EMAIL PROTECTED] - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
- [tcpdump-workers] Decoding ISL encapsulated packets sthaug
- Re: [tcpdump-workers] Decoding ISL encapsulated packet... Guy Harris
- Re: [tcpdump-workers] Decoding ISL encapsulated packet... Bill Fenner
- Re: [tcpdump-workers] Decoding ISL encapsulated packet... sthaug
- Re: [tcpdump-workers] Decoding ISL encapsulated packet... Guy Harris
- [tcpdump-workers] SMB changes in Ethereal Richard Sharpe
- Re: [tcpdump-workers] Decoding ISL encapsulated packet... Bill Fenner
