Wireshark-users: Re: [Wireshark-users] Missing packet padding bytes on Mac

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 19 Nov 2009 12:18:19 -0800

On Nov 19, 2009, at 6:22 AM, Tatakis, Thomas (Tom) wrote:

I was recently debugging a CDP protocol issue with version 1.2.3 on a Mac platform. The device I was debugging was adding padding bytes to the packets to an 8 byte boundary. These bytes did not show up in the trace on the Mac platform. However, when I used version 1.0.3 on a PC platform, these bytes did show up as part of the trace.

So presumably you're capturing traffic from the device on both machines?

What operating system was the PC running? If it's running Windows, what happens if you install version 1.2.4 (the latest 1.2.x release) and try capturing that traffic? (If it's not running Windows - e.g., if it's running Linux - see whether you can install some 1.2.x release and try that.)

What type of network is this on? If it's Ethernet, CDP puts a length field, rather than a type field, in the MAC header; what is the value of the length field?