On Dec 4, 2009, at 8:50 PM, Scott and Germaine James wrote:
DOCSIS is not one of the DLTs supported by this device).
what is this about
Is that a message that was printed when you ran tcpdump? (The
equivalent message in Wireshark/TShark/dumpcap is "That DLT isn't one
of the DLTs supported by this device".)
If so, was it because you tried capturing on, for example, a Wi-Fi
(802.11) device with "-y DOCSIS"?
If so, that's not supported. "-y DOCSIS" is supported on Ethernet
because some Cisco cable modem head-end equipment can put DOCSIS
frames onto an Ethernet cable plugged into the device; what it does is
uses the very low-level framing mechanism of Ethernet, but, instead of
putting Ethernet frames, with a standard Ethernet header, on the
cable, it puts DOCSIS frames on the cable. That flag causes the link-
layer type of the capture to be marked as DOCSIS, not Ethernet, so
that the capture will be properly interpreted by, for example,
Wireshark and TShark. Cisco doesn't, as far as I know, support
putting DOCSIS frames onto 802.11 networks in that fashion.