Hi all, I am wondering how the libpcap engine determine the type of layer 3 (issit IP or IPX...blah blah) protocol during a capture.
I was doing a capture with a WAN card that will stripe away the L2 header. so...ethereal reported a "ARP type unknown" and replaced the L2 with a Linux Cooked Socket instead. The miraculous thing is that it actually identified the L3 protocol type correctly as IP (0x0800) in the Linux Cooked socket header even though the original L2 header is no longer avbl. any ideas?
