On Mon, May 22, 2000 at 08:37:40AM -0500, Yaniv Kaul wrote:
>
>
> Can it be done / Wish list item:
> After capture, some packets were parsed using the wrong parser. Can I force
> them to be parsed (after capture) using a different parser?
It cannot be done yet. If we change all our dissectors to use the dissector_table
routines, we can add a GUI which will allow the user to redefine these
dissector-to-sub-dissector associations.
> In my specific case, some proprietry format packets were parsed as LLC. It
> would be very helpful if I could have seen them parsed as Ethernet II (and
> not as IEEE 802.3).
If the "type" field is less than IEEE_802_3_MAX_LEN (1500) then the field
is considered a length, and the packet is 802.3. If the "type" field is > 1500,
the field is indeed considered a "type" and the packet is considered Eth II.
How can your frame have a "type"/"length" field < 1500 and not have LLC after
it? What is the "type"?
--gilbert