> Dear Ethereal-Users,
>
> when I try to capture token ring traffic with a Madge Smart Ringnode Mk2
> I receive the following messages:
>
> [root@lahmekiste /root]# ethereal
> WARNING: unsupported device type 0x320, assuming raw
> WARNING: unsupported device type 0x320, assuming raw
0x320 is 800. That's the *new* ARPHRD_ value, ARPHRD_IEEE802_TR, for
token ring devices, in the 2.4[.x] kernel; Linux used to use
ARPHRD_IEEE802 for that.
This means either that
1) Red Hat haven't updated libpcap to know about
ARPHRD_IEEE802_TR
or
2) the libpcap that comes with your system doesn't know about
token ring at all.
In either case, that's a bug; complain to Red Hat.
> I assume that Ethereal isn't aware that there is token ring traffic on
> the network and misinterprets the frames.
Correct.
It's not aware of that because libpcap isn't telling it that; libpcap is
just screwing up.
> Reading a file captured with
> sniffer from NAI works excellent. Is there a possibility to tell
> Ethereal that it is capturing on a token ring?
There is a possibility that libpcap could be fixed to do so; you'd
either have to get Red Hat to fix libpcap, or install the tcpdump.org
version of libpcap and build Ethereal from source to use it.
> I couldn't find anything
> about unsupported device types in the documentation.
That's because that message comes from libpcap, not Ethereal.