Ethereal-users: Re: [Ethereal-users] resolving HW (MAC) addresses

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Thu, 22 Mar 2001 10:14:53 -0800 (PST)
> >Please print, to a file, one of the packets you claim don't have IP
> >addresses in the protocol tree:
> 
> I have attached the packet to this email.
> 
> I have also noticed that on the man page for my version of ethereal
> (0.8.3.10)

Then you're running an old version of Ethereal.  (0.8.3.*10*?  Our
version numbers don't have four components; this must be some binary
package somebody produced, but I'm assuming the *real* version number is
0.8.3.)

> there is no mention of MPLS support,

MPLS support was added in release 0.8.5; if you're running a version
before that, you will get all MPLS packets dissected as data - you won't
even get the MPLS headers dissected, much less the MPLS payload.

(MPLS support was checked in *over a year ago*; you really need to get a
newer version of Ethereal than 0.8.3....)

> will this effect the reading of IP packet info.

Probably, as we've changed the IP dissector since then.

What matters here, though, is how it affects the reading of *MPLS*
packet info; Ethereal is *not* processing the MPLS data in:

> Frame 1 (102 on wire, 102 captured)
>     Arrival Time: Mar 22, 2001 10:23:29.1991
>     Time delta from previous packet: 0.000000 seconds
>     Frame Number: 1
>     Packet Length: 102 bytes
>     Capture Length: 102 bytes
> Ethernet II
>     Destination: 00:80:c8:c9:af:21 (00:80:c8:c9:af:21)
>     Source: 00:80:c8:c9:94:36 (00:80:c8:c9:94:36)
>     Type: Unknown (0x8847)
> Data (88 bytes)
> 
>    0  0001 113e 4500 0054 0000 4000 4001 eaa2   ...>E..T..@.@... 
>   10  1e00 0001 3200 0006 0800 1e1e 8b01 0072   ....2..........r 
>   20  3ab9 d35b 0003 5553 0809 0a0b 0c0d 0e0f   :..[..US........ 
>   30  1011 1213 1415 1617 1819 1a1b 1c1d 1e1f   ................ 
>   40  2021 2223 2425 2627 2829 2a2b 2c2d 2e2f    !"#$%&'()*+,-./ 
>   50  3031 3233 3435 3637                       01234567         

("Type: Unknown" is a bit of a giveaway there).  If it's not even
dissecting the MPLS header - i.e., if it knows nothing of MPLS - it's
obviously not going to dissect the IP packet following the MPLS header.