Ethereal-users: Re: [Ethereal-users] Forcing a decode offset

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Fri, 14 Sep 2001 17:15:27 -0700 (PDT)
> I am using ethereal 0.8.16. Is there a way I can 
> configure it to start decoding packets from a 
> specific offset i.e skip the encapusaltion 

What do you mean by "start decoding packets from a specific offset?"

If you start decoding at, say, the offset of the first byte after the
link-layer, you don't necessarily know *how* to dissect the data.  In
an Ethernet packet, the protocol type field appears in the link layer,
so if you start decoding after the link-layer header, you don't know
what dissector should handle the rest of the packet (The IP or IPv6
dissector?  The ARP dissector?  The IPX dissector?  The ...?).