tcpdump mailing list archives

Re: Variable length mac headers and gencode.c (and DLT request)


From: Guy Harris <guy () alum mit edu>
Date: Thu, 12 May 2011 04:27:09 -0700


On May 10, 2011, at 1:40 PM, Darren Reed wrote:

To pursue this a little further, experimenting has
determined that the best layout thus far would be
something similar to this:

bits  field
00-07 version (1)
08-15 pad (0)
16-31 pre-mac payload length
32-63 dlt (DLT_*)
64-79 ethernet protocol number
80-95 pad (0)

What about packets for which there is no appropriate Ethernet protocol number value, such as:

        various link control protocols for PPP;

        management and control frames for 802.11 (and similar frames for older LAN technologies such as FDDI and Token 
Ring);

        LAN frames with 802.2 headers with DSAPs for which there's no Ethernet protocol number;

        LAN frames with 802.2+SNAP headers with an OUI other than 0x000000;

etc.?

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.


Current thread: