Wireshark-users: Re: [Wireshark-users] Distinguishing Ethernet II and 802.3 frames

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Marcus Better <marcus@xxxxxxxxx>
Date: Thu, 06 Mar 2008 11:28:51 +0100
Guy Harris wrote:
> maxValidFrame is 1500, so if the length/type field has a value in the
> range 1501 through 1535, 802.3-2005 doesn't specify how to interpret the
> frame.

I see, thanks for the explanation.

> Unfortunately, OS X doesn't follow in the footsteps of
> {Free,Net,Open,DragonFly}BSD by allowing an application using BPF to
> select either Ethernet or 802.11 headers, regardless of whether you're
> capturing in monitor mode or not,

I'm running Wireshark on Linux 2.6.24 though (mac80211 stack). Can it give
me the 802.11 frames?

Regards,

Marcus