https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2718
--- Comment #2 from Jürgen <jboehm@xxxxxxxxxxxxxx> 2008-07-18 07:19:27 PDT ---
First of all was the question concerning the SFD and Ethernet II bullshit!
Ethernet II does not contain a SFD byte but this byte is included in the
preamble. I guess I was puzzled.
But still – Why is an Ethernet II frame containing a LLC field?
The following block is what I captured on the bus.
*****************************************
0000 02 00 01 00 00 01 02 00 01 00 00 01 81 00 60 01
0010 00 2e de 00 03 0c f8 00 00 00 00 00 00 00 00 cc
0020 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
0030 cc cc cc cc cc cc cc cc cc cc cc cc
*****************************************
and that is how Wireshark is interpreting it
*****************************************
+ Frame 160 (60 bytes on wire, 60 bytes captured)
- Ethernet II, Src: 02:00:01:00:00:01 (02:00:01:00:00:01), Dst:
02:00:01:00:00:01 (02:00:01:00:00:01)
+ Destination: 02:00:01:00:00:01 (02:00:01:00:00:01)
+ Source: 02:00:01:00:00:01 (02:00:01:00:00:01)
Type: 802.1Q Virtual LAN (0x8100)
+ 802.1Q Virtual LAN, PRI: 3, CFI: 0, ID: 1
+ Logical-Link Control
+ Data (39 bytes)
*****************************************
Due to the fact a VLAN frame is send we use the type field (0x8100) and
therefore have an Ethernet II Frame.
But as far as I know is this not correct! If VLAN is used, the field after the
VLAN tag (length or type filed) decides what kind of frame (Ethernet 802.3 or
Ethernet II) is send.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.