Ethereal-users: [Ethereal-users] OT: How does ethereal/libpcap determine the layer 3 type?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "darren" <teodarren@xxxxxxxxxxxxx>
Date: Wed, 03 Sep 2003 03:45:52 +0000
Hi all,

I am wondering how the libpcap engine determine the type of layer 3 (issit IP or IPX...blah blah) protocol during a capture.

I was doing a capture with a WAN card that will stripe away the L2 header.

so...ethereal reported a "ARP type unknown" and replaced the L2 with a Linux Cooked Socket instead. The miraculous thing is that it actually identified the L3 protocol type correctly as IP (0x0800) in the Linux Cooked socket header even though the original L2 header is no longer avbl.

any ideas?