On Thu, Jul 25, 2002 at 06:00:58PM +0200, Gerd Dauenhauer wrote: > I am using the pcap library in a site-specific application that sniffs > ethernet packets. > Things work well when I match for "ether proto 0x800" (IP packets), but > not when I match for "ether proto 0x30" (roaming packets used by Proxim > WLANs).
(Note that Ethernet protocol types have to be at least 1500 or so (my copy of IEEE Std 802.3 is at home, so I don't know the *exact* number), so a packet with 0x30 in the type/length field of the Ethernet header is supposed to be interpreted as an 802.3 packet with 14 bytes of header and 48 bytes of payload, with the payload starting with an 802.2 header. But perhaps your Proxim-to-Ethernet gateway is cheating and sending those packets out with an illegal-according-to-the-standard type field of 0x30.) When you say that things don't work well, what do you mean? Do you mean you don't see the packets? - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
