On May 10, 2011, at 1:40 PM, Darren Reed wrote:
> To pursue this a little further, experimenting has
> determined that the best layout thus far would be
> something similar to this:
>
> bits field
> 00-07 version (1)
> 08-15 pad (0)
> 16-31 pre-mac payload length
> 32-63 dlt (DLT_*)
> 64-79 ethernet protocol number
> 80-95 pad (0)
What about packets for which there is no appropriate Ethernet protocol number
value, such as:
various link control protocols for PPP;
management and control frames for 802.11 (and similar frames for older
LAN technologies such as FDDI and Token Ring);
LAN frames with 802.2 headers with DSAPs for which there's no Ethernet
protocol number;
LAN frames with 802.2+SNAP headers with an OUI other than 0x000000;
etc.?
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
