Wireshark-users: Re: [Wireshark-users] Get rid of LLC

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 23 Feb 2007 12:03:19 -0800
Martin Andersson wrote:

I have a Netgear wlan and when capturing on the machine (connected over the wlan to the Netgear), it constantly recives LLC packets.
How can capture/filter them out, since they are very annoying.

I assume by "Netgear wlan" you mean a Netgear access point/wireless router.

On what operating system are you capturing this traffic? What type of WLAN adapter do you have on the computer you're using to capture the traffic?

Example:
No.  1
Time 0.000000 Source Netgear_7e:39:d4 Destination IntelCor_19:32:c3 Protocol LLC Info I, N(R)=0, N(S)=0; DSAP NULL LSAP Individual, SSAP NULL LSAP Command

Frame 1 (1490 bytes on wire, 1490 bytes captured)
IEEE 802.3 Ethernet
Logical-Link Control

Could you give us an example with the "Frame", "IEEE 802.3 Ethernet", and "Logical-Link Control" sections expanded? The adapter and/or its driver is probably supplying frames in a format that Wireshark isn't expecting (and that might, in fact, not be the correct format).