Actually, I have "Ethernet type II style frames", but if I disable my plugin, I can see that ETH dissector find a trailer, without having a length in type/length field. Moreover, I know that in my frames, the padding is added by the ethernet layer, so I should dissect the trailer at the ethernet level.
I saw ETH dissector uses a pseudo header with FCS length, but I can't reuse this value in my heuristic dissector (because not defined when heuristic dissector list is called) and I don't know how to do it without this value... Thanks for your help Yvan ________________________________ De : Richard Brodie <[email protected]> À : [email protected] Envoyé le : Mercredi, 6 Mai 2009, 1h08mn 41s Objet : Re: [Wireshark-dev] Ethernet trailer > Moreover, I don't understand how ethernet dissector can find if there is padding or not. You can only do this with '802.3' style frames where the type/length field contains a length. In the typical case, where the type/length field identifies a type, it's all passed up to the next layer which will have to work it out for itself. Richard Brodie. ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
