[Guy Harris <gharris@xxxxxxxxx>]

On Mon, Mar 22, 2004 at 10:02:03AM +0100, Zanetta Michael wrote:
> here is a link to the tpdump.pdf document. It is so old, about 1999
> and I would be very surprised if the format had changed since...

...and it's just a tcpdump man page, which doesn't describe the format
of the presumably-synthetic link-layer headers in the file.

The current CVS versions of tcpdump from tcpdump.org and of Ethereal
make an attempt to read packets in that format - there appears to be an
Ethernet type field in the link-layer header, as well as 6 bytes of
mysterious junk before the type field and 36 bytes of 0 after the type
field.  Without a description of the contents of the remaining 42 bytes
there's not much we can do to dissect it (assuming it even contains
useful information).