On Thu, 2002-07-25 at 13:50, Guy Harris wrote: > On Thu, Jul 25, 2002 at 06:00:58PM +0200, Gerd Dauenhauer wrote: > > I am using the pcap library in a site-specific application that sniffs > > ethernet packets. > > Things work well when I match for "ether proto 0x800" (IP packets), but > > not when I match for "ether proto 0x30" (roaming packets used by Proxim > > WLANs). > > (Note that Ethernet protocol types have to be at least 1500 or so (my > copy of IEEE Std 802.3 is at home, so I don't know the *exact* number), > so a packet with 0x30 in the type/length field of the Ethernet header is > supposed to be interpreted as an 802.3 packet with 14 bytes of header > and 48 bytes of payload, with the payload starting with an 802.2 header.
If the code in tcpdump and Ethereal is right, and it probably is, then 1500 is correct. --gilbert - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
