Thanks for the replies, sorry for not getting back sooner. This is exactly the information I wanted to know. In addition, can anyone point me to the documentation where these boundaries are specified?
Thanks in advance, Jason Allison Principal Engineer ARINC Incorporated Office: (410) 266-2006 FAX: (410) 573-3026 -----Original Message----- From: Andrew Brown [mailto:[EMAIL PROTECTED] Sent: Saturday, May 31, 2003 10:10 AM To: Guy Harris Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED] Subject: Re: [tcpdump-workers] Libpcap :: 802.3 and Ethernet headers >> Am looking at the headers from 802.3 and Ethernet (RFC 894). My >> question is: Off the wire how does one, libpcap for example, >> differenciate between 802.3 and Ethernet encapsulation? > >By looking at the type/length field. If it's <= 1500, it's 802.3; if >it's >> 1500, it's Ethernet. (Actually, as I remember, according to the spec >there's a small set of values that are neither valid for 802.3 nor for >Ethernet, but I don't remember what the range is.) that'd be 05dd to 05ff. 05dc is 1500, and 0600 is xerox ns idp. :) -- |-----< "CODE WARRIOR" >-----| [EMAIL PROTECTED] * "ah! i see you have the internet [EMAIL PROTECTED] (Andrew Brown) that goes *ping*!" [EMAIL PROTECTED] * "information is power -- share the wealth." - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]
