Ethereal-dev: Re: [Ethereal-dev] Ethereal & Layer 3 tapping

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Tue, 8 Apr 2003 13:41:48 -0700
On Tue, Apr 08, 2003 at 03:27:59PM -0400, Marc Milgram wrote:
> I was planing on expanding this parser to handle ARP and ICMP packets -
> which are output differently than other IP packets.  I found that if I
> took the data from one of these packets, and stuffed it in an IP packet,
> ethereal would handle the packet correctly.

That seems unlikely for ARP packets.  ICMP packets are IP packets, so
they have IP headers, but ARP packets aren't IP packets, and there's no
mechanism for stuffing ARP packets inside IP packets.