Ethereal-dev: Re: [ethereal-dev] Force a different parsing of a packet, after capture

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Gilbert Ramirez <gram@xxxxxxxxxx>
Date: Mon, 22 May 2000 11:09:22 -0500
On Mon, May 22, 2000 at 08:37:40AM -0500, Yaniv Kaul wrote:
> 
> 
> Can it be done / Wish list item:
> After capture, some packets were parsed using the wrong parser. Can I force
> them to be parsed (after capture) using a different parser?

It cannot be done yet. If we change all our dissectors to use the dissector_table
routines, we can add a GUI which will allow the user to redefine these
dissector-to-sub-dissector associations.

> In my specific case, some proprietry format packets were parsed as LLC. It
> would be very helpful if I could have seen them parsed as Ethernet II (and
> not as IEEE 802.3).

If the "type" field is less than IEEE_802_3_MAX_LEN (1500) then the field
is considered a length, and the packet is 802.3. If the "type" field is > 1500,
the field is indeed considered a "type" and the packet is considered Eth II.

How can your frame have a "type"/"length" field < 1500 and not have LLC after
it? What is the "type"?

--gilbert