> Any suggestions? Is this an ethereal bug or possibly a libpcap bug?
Libpcap bug (and yet another reason why, at times, I think the term
"Linux distributor" should be replaced by "Linux agglutinator" -
sometimes it appears that at least some Linux distributions consist of a
number of pieces of software rammed together at high speed without any
actual checking as to whether the pieces actually work together).
The 2.4[.x] kernel, which is what I suspect you're running, changed the
ARPHRD_ type for Token Ring from ARPHRD_IEEE802 to ARPHRD_IEEE802_TR;
ARPHRD_IEEE802_TR has the value 800, i.e. 0x320.
It appears that the libpcap on your system doesn't include support for
ARPHRD_IEEE802_TR.
Fortunately, libpcap 0.7 beta does; go to
http://www.tcpdump.org/
and download the beta (from the "Beta files" link under the note
TCPDUMP 3.7
TCPDUMP version 3.7.0 is in beta.
). Compile and install the resulting libpcap (probably under
"/usr/local"), and then re-configure Ethereal with "--with-pcap=XXX",
where "XXX" is the directory under which the new libpcap was installed
(e.g., "--with-pcap=/usr/local").