JALLISON said: > Am looking at the headers from 802.3 and Ethernet (RFC 894). My > question is: Off the wire how does one, libpcap for example, > differenciate between 802.3 and Ethernet encapsulation?
By looking at the type/length field. If it's <= 1500, it's 802.3; if it's > 1500, it's Ethernet. (Actually, as I remember, according to the spec there's a small set of values that are neither valid for 802.3 nor for Ethernet, but I don't remember what the range is.) - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]
