In the packet stream, first few bytes are proprietary
encapsulation and then ethernet header starts.
So, if there is a simple way to have ethereal start
looking at the mac layer always after x number of
bytes.
-Dinesh
--- Guy Harris <guy@xxxxxxxxxx> wrote:
> > I am using ethereal 0.8.16. Is there a way I can
> > configure it to start decoding packets from a
> > specific offset i.e skip the encapusaltion
>
> What do you mean by "start decoding packets from a
> specific offset?"
>
> If you start decoding at, say, the offset of the
> first byte after the
> link-layer, you don't necessarily know *how* to
> dissect the data. In
> an Ethernet packet, the protocol type field appears
> in the link layer,
> so if you start decoding after the link-layer
> header, you don't know
> what dissector should handle the rest of the packet
> (The IP or IPv6
> dissector? The ARP dissector? The IPX dissector?
> The ...?).
__________________________________________________
Terrorist Attacks on U.S. - How can you help?
Donate cash, emergency relief information
http://dailynews.yahoo.com/fc/US/Emergency_Information/