Ethereal-users: Re: [Ethereal-users] captute raw HDLC IP data?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 5 Feb 2001 14:37:43 -0800 (PST)
> I am running Ethereal on WindowsNT.
> I am trying to capture raw Ethernet data, i.e., HDLC frames that contain
> network data while keeping the HDLC frames intact.

"Raw Ethernet data" isn't HDLC, it's Ethernet.  Ethernet packets don't
use HDLC headers; *some* 802.3/Ethernet packets include 802.2 LLC
headers, and LLC is somewhat HDLC-like, but it's not HDLC.

If you want to capture raw Ethernet data, Ethereal and WinPcap will do
that on Ethernet devices.  They will capture the entire packet,
including the Ethernet/802.3 header, as well as the payload, which, for
802.2 LLC frames, would include the 802.2 LLC header.

> Is there a documentation explaining the file format specs that
> Ethereal/WinPcap capture.

The file format it uses is libpcap format; there's no documentation I
know of for that other than the source code.