On Wed, Aug 01, 2001 at 10:58:22PM +0200, [EMAIL PROTECTED] wrote:
> > I started writing this code but put it in the "case OUI_CISCO:" around
> > line 224; was I missing something that required it being outside the
> > case?
>
> I think it would work just fine to have it there.
If that's checking for the OUI in the mostly-looks-like-Ethernet-plus-802.2-
plus-SNAP header, I have a trace here (sent to one of the Ethereal
mailing lists, I think) where the HSA field (which is in the position
that would correspond to the OUI field in that header) has the value
0x00107b, rather than 0x00000c - both of those OUIs belong to Cisco,
according to
http://www.cavebear.com/CaveBear/Ethernet/vendor.html
I have another one with 0050d1, which that page doesn't list as Cisco's,
but
http://standards.ieee.org/regauth/oui/oui.txt
does list as one of Cisco's.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
