On Wed, Feb 18, 2004 at 10:30:43PM +0100, Martin Regner wrote: > Maybe it is captured with some special Nokia tcpdump version.
Apparently so. > If I remove the four first octets for each packet (by using text2pcap) and > set linktype to 100 then I see LLC-SNAP/IP/GTP/IP/.. packets > that looks reasonable, And if I dissect them as something like an ATM pseudo-header, with the 0x80 bit in the first byte being a direction flag, and the VPI/VCI following, they appear to be traffic for VPI 0, VCI 500. I've checked in a change to interpret them as such. I don't guarantee that the direction flag or VPI/VCI is correct. _______________________________________________ Ethereal-users mailing list [EMAIL PROTECTED] http://www.ethereal.com/mailman/listinfo/ethereal-users
