[julien.leproust@xxxxxxxx]

Hello,

bunty a écrit :
>         I want to know why some times i get protocols in frame output 
> for icmp packets as eth:ip:icmp and sometimes sll:ip:icmp?
>         why same pc recognises icmp pacekts as eth as well as sll? I am 

SLL is Linux cooked mode capture. It is a fake link-layer header, used 
instead of the real link-layer header (Ethernet) when capturing on the 
fake 'any' interface (regardless of the link types). It should contain 
the source MAC address if available, the protocol id, and other 
link-layer related information.

Regards,

--
Julien Leproust