Wireshark-users: Re: [Wireshark-users] 802.15.4 Decode

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 23 Sep 2008 18:15:36 -0700

On Sep 23, 2008, at 5:54 PM, Colin O'Flynn wrote:

However I also put in a "raw" mode, which gives you the 802.15.4 packets without being decoded. I can send them however I want over the interface - aka right now I put on 14 bytes that is the ethernet header. There is no need
for me to do this, I could send just the 802.15.4 data.

So, in that mode, can you do IP-over-802.15.4, or is that a sniff-only mode (because it's not handing "real" Ethernet packets to the host, with, for example, an Ethernet type of 0x86dd for IPv6, but is instead handing to the host 802.15.4 packets with the extra Ethernet header with an Ethernet type that the host's networking stack won't recognize)?

And on what OSes are you doing this? (I.e., what host OS's networking stacks are getting these packets?)