tcpdump mailing list archives
Re: Libpcap :: 802.3 and Ethernet headers
From: Andrew Brown <atatat () atatdot net>
Date: Sat, 31 May 2003 10:09:32 -0400
Am looking at the headers from 802.3 and Ethernet (RFC 894). My question is: Off the wire how does one, libpcap for example, differenciate between 802.3 and Ethernet encapsulation?By looking at the type/length field. If it's <= 1500, it's 802.3; if it's1500, it's Ethernet. (Actually, as I remember, according to the specthere's a small set of values that are neither valid for 802.3 nor for Ethernet, but I don't remember what the range is.)
that'd be 05dd to 05ff. 05dc is 1500, and 0600 is xerox ns idp. :) -- |-----< "CODE WARRIOR" >-----| codewarrior () daemon org * "ah! i see you have the internet twofsonet () graffiti com (Andrew Brown) that goes *ping*!" werdna () squooshy com * "information is power -- share the wealth." - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe
Current thread:
- Libpcap :: 802.3 and Ethernet headers Allison, Jason (JALLISON) (May 30)
- Re: Libpcap :: 802.3 and Ethernet headers Andrew Brown (May 30)
- Re: Libpcap :: 802.3 and Ethernet headers Guy Harris (May 30)
- Re: Libpcap :: 802.3 and Ethernet headers Andrew Brown (May 31)
- <Possible follow-ups>
- RE: Libpcap :: 802.3 and Ethernet headers Allison, Jason (JALLISON) (Jun 03)
- Re: Libpcap :: 802.3 and Ethernet headers Andrew Brown (Jun 03)
- Re: Libpcap :: 802.3 and Ethernet headers Guy Harris (Jun 03)