["Ronnie Sahlberg" <sahlberg@xxxxxxxxxxxxxxxx>]

>While the type of layer3 packet and hence the choice of dissector can be
>determined by determining the layer2 data, how does Ethereal determine
>the layer-2 protocol encapsulating the L3 data?

I ehtereal is capturing from an interface, then libpcap which handles the
interaction with the OS specific
capturing mechanism will get its information from the OS and then tell
ethereal which layer2 protocol
is being read.

If ethereal is reading from a capture file, the header in the capturefile
will tell ethereal which layer2 or layer3
protocol is encapsulated in the file (or per packet)


(
some capture filetypes do not contain any layer2 information, some does not
even contain layer3 but only
layer4 and upward. most capture files are much more sane.
)