Ethereal-users: Re: [Ethereal-users] problems sniffing Gigabit

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxx>
Date: Fri, 26 Apr 2002 11:59:26 -0700
On Fri, Apr 26, 2002 at 02:15:01PM -0400, Michael Cirulli wrote:
> The same capture for the gigabit interface is showing for the ARP  (x'70'
> bytes)
> 
> 45 00

That looks like the beginning of an IP header.  Are you certain that
packet *is* an ARP packet, rather than an IP packet?

If that's what it is, this is probably a bug in the driver for that
particular gigabit interface; that driver may be doing something stupid
such as setting "mac.raw" in the skbuff for incoming packets to point to
the beginning of the Ethernet *payload* rather than the beginning of the
Ethernet *header*.

Try using tcpdump and, if it has the same problem, complain to whoever
maintains the driver for that interface.