Guy Harris <guy@...> writes:
> > But if 1501-1535 are invalid, maybe at the very least an Expert Info should
be added to
> > report it?
>
> Yes.
>
> My copy of version 1 of the DEC/Intel/Xerox Ethernet spec doesn't say anything
about valid type field
> values, unless I missed it. Perhaps version 2 does; in any case, perhaps we
should dissect frames with
> type/length fields in that range as invalid rather than as having a type *or*
length field.
OK, I committed a change so those invalid Ethernet frames will be dissected as
such, and added an expert info as well. Not quite sure what to do in
capture_eth() though, as I'm not completely sure what that function is for;
maybe you could have a look?