Wireshark mailing list archives
Re: Extracting outer MAC Address
From: Jim Young <jyoung () gsu edu>
Date: Mon, 19 Jan 2015 07:35:00 +0000
Hello Rayne, On Monday, January 19, 2015 1:58 AM, Rayne <hjazz6 () ymail com> wrote:
I see 2 full Ethernet headers in Wireshark - Ethernet with Source/Dest MAC address, IPv4, EtherIP Version 4, Ethernet with Source/Dest address, 802.1Q VLAN, IP. Wireshark can dissect it.
Is is possible to attach a small example capture file of what you are looking at? One packet should do. Your description does not sound exactly like like the following, but there are encapsulating protocols such as IEEE 802.1ah-2008, Provider Backbone Bridge (http://en.wikipedia.org/wiki/IEEE_802.1ah-2008) that do MAC-in-MAC style encapsulation. Assuming Wireshark recognizes your packet as something like an IEEE 802.1ah packet there might be a protocol specific display filter that could get you the "outer" header's source mac value you seek. Regards, Jim Y. ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- Extracting outer MAC Address Rayne (Jan 18)
- Re: Extracting outer MAC Address Guy Harris (Jan 18)
- Re: Extracting outer MAC Address Rayne (Jan 18)
- Re: Extracting outer MAC Address Jim Young (Jan 18)
- Re: Extracting outer MAC Address Rayne (Jan 19)
- Re: Extracting outer MAC Address Sake Blok (Jan 19)
- Re: Extracting outer MAC Address Rayne (Jan 19)
- Re: Extracting outer MAC Address Rayne (Jan 19)
- Re: Extracting outer MAC Address Evan Huus (Jan 20)
- Re: Extracting outer MAC Address Rayne (Jan 18)
- Re: Extracting outer MAC Address Guy Harris (Jan 18)
- Re: Extracting outer MAC Address Sake Blok (Jan 19)