Re: [Wireshark-users] 12 bytes before the IP header

2007-09-23 Thread Aleksander Veksler
[mailto:wireshark-users- >> [EMAIL PROTECTED] On Behalf Of Aleksander Veksler >> Sent: Wednesday, September 19, 2007 7:23 PM >> To: wireshark-users@wireshark.org >> Subject: Re: [Wireshark-users] 12 bytes before the IP header >> >> Hello again guys, >> >&

Re: [Wireshark-users] 12 bytes before the IP header

2007-09-19 Thread Small, James
> From: [EMAIL PROTECTED] [mailto:wireshark-users- > [EMAIL PROTECTED] On Behalf Of Aleksander Veksler > Sent: Wednesday, September 19, 2007 7:23 PM > To: wireshark-users@wireshark.org > Subject: Re: [Wireshark-users] 12 bytes before the IP header > > Hello again guys,

Re: [Wireshark-users] 12 bytes before the IP header

2007-09-19 Thread Aleksander Veksler
Hello again guys, Sorry for the delay. The procedure Sake Block recommended didn't work. I first thought it was because there was a trailer, so I tried with trailer sized 1,2,3 and four (see the packet to see why), but this didn't work. There seem to be a bug in DLT_USER configuration pag

Re: [Wireshark-users] 12 bytes before the IP header

2007-09-07 Thread Aleksander Veksler
Siterer Joerg Mayer <[EMAIL PROTECTED]>: > On Fri, Sep 07, 2007 at 12:23:54AM +0200, Aleksander Veksler wrote: >> Anyone have tips on how you loose a few bytes? I get 12 bytes between >> the Ethernet header and IP header. This means that wireshark does not >> recognize the IP header as, and I can'

Re: [Wireshark-users] 12 bytes before the IP header

2007-09-07 Thread Aleksander Veksler
I think the length is correct. I forgot to tell, I disabled the LLC dissector. Before I did, it attempted to decode the first 4 bytes, but failed to to anything meaningfull: DSAP unknown, SSAP unknown. I am going out of town today, will answer in full when I am back on monday next week. Than

Re: [Wireshark-users] 12 bytes before the IP header

2007-09-07 Thread Aleksander Veksler
Hello again, and thank you for the quick response! This looks like a solution, yes. There seems to be no http traffic over my network right now (except mine), but it looks like the solution for the problem. I have seen the DLT_USER before, but I thought the header_size was supposed to be the

Re: [Wireshark-users] 12 bytes before the IP header

2007-09-07 Thread Joerg Mayer
On Fri, Sep 07, 2007 at 12:23:54AM +0200, Aleksander Veksler wrote: > Anyone have tips on how you loose a few bytes? I get 12 bytes between > the Ethernet header and IP header. This means that wireshark does not > recognize the IP header as, and I can't use any of the wireshark's > advanced f

Re: [Wireshark-users] 12 bytes before the IP header

2007-09-06 Thread Guy Harris
On Sep 6, 2007, at 3:23 PM, Aleksander Veksler wrote: > Anyone have tips on how you loose a few bytes? I get 12 bytes > between the Ethernet header and IP header. That's the "length field" version of the Ethernet header, not the "type field" version, so those 12 bytes appear to be... > This

Re: [Wireshark-users] 12 bytes before the IP header

2007-09-06 Thread Sake Blok
Hi Aleksander, > Anyone have tips on how you loose a few bytes? I get 12 bytes between > the Ethernet header and IP header. This means that wireshark does not > recognize the IP header as, and I can't use any of the wireshark's > advanced features. > > Anyone know how to get rid of those by

[Wireshark-users] 12 bytes before the IP header

2007-09-06 Thread Aleksander Veksler
Hello people, Anyone have tips on how you loose a few bytes? I get 12 bytes between the Ethernet header and IP header. This means that wireshark does not recognize the IP header as, and I can't use any of the wireshark's advanced features. Anyone know how to get rid of those bytes, or per