Wireshark-dev: Re: [Wireshark-dev] Ethernet dissector

From: Guy Harris <gharris@xxxxxxxxx>
Date: Sun, 23 May 2021 11:54:02 -0700
On May 23, 2021, at 8:58 AM, Antonello Tartamo <antonellotartamo@xxxxxxxxx> wrote:

> The problem is that I don't have a predefined ether type as the ether type field is used as length field.

So the frames start with:

	a 6-octet Ethernet destination address;

	a 6-octet Ethernet source address;

	a 2-octet type/length field with a value <= 1500, indicating that its value is a length rather than an Ethernet type?

If so, what follows the type/length field?  An IEEE 802.2/ISO 8802 LLC header, with a 1-octet DSAP, a 1-octet LSAP, and a control field?  Or something else?