Hi,I think I may have stumbled onto a wireshark bug (ethereal version 0.99.0, libpcap version 0.8.3 on RHEL4). An application on which I'm working is receiving UDP packets over gigabit Ethernet from some custom hardware. The packets have a fixed source and destination UDP port number, which we had set to 12001 and 12000, respectively. Wireshark shows an LLC header after the UDP header, which is simply not present; see first attachment (bad.pcap). In the process of poking around a bit, I changed the UDP port numbers to 12032 and 12048 in the pcap file, and wireshark no longer reported the LLC header; see second attachment (good.pcap). Unless I'm totally missing something about LLC (definite possibility), this looks like a bug in wireshark or libpcap.
I'm not subscribed to this list, please send questions to me directly. -- Martin
bad.pcap
Description: Binary data
good.pcap
Description: Binary data
_______________________________________________ Wireshark-users mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-users
