[Guy Harris <guy@xxxxxxxxxx>]

> Guy, would it possible to display the LLC/SNAP header info in the link
> layer decode?

Considering that there *is* no LLC/SNAP header information in that
capture (note that, if you click on "Internet Protocol" in the protocol
tree view, it marks stuff starting at the very beginning of the packet),
no, it wouldn't be possible.

I guess the Linux kernel code takes the "IP" part of "Classical IP"
seriously, and throws out the LLC header; it's sort of like the PPP
code, which also makes the link-layer header unavailable even to
SOCK_PACKET or PF_PACKET sockets.