Ethereal-dev: Re: [Ethereal-dev] Building&Running 0.8.16 under W2K

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Wed, 21 Mar 2001 10:59:14 -0800
On Wed, Mar 21, 2001 at 02:07:19PM +0100, Peter Dons Tychsen wrote:
> Is there a type in PCAP which indicates that the link type is unknown ?

No.  You *HAVE* to have *SOME* kind of link-layer header, even if it's
"no link-layer header" (i.e., DLT_RAW, which means "IP only", no IPX or
anything else).

> The problem is, that i have an undefined link on the router which can 
> be of type IPv4, IPX or maybe a third type. I cannot set a definite 
> type in the PCAP file (my output). 

Neither IPX nor IPv4 are link-layer protocols.

You haven't specified how you're going to get these packets in the first
place.  Is there some way the router can be told to provide raw packet
data?  If so, is that the mechanism you're using to get the packet data?

If so, what data does the router provide?  Just the payload above the
link-layer, with no indication of what type of packet it is?  (If so,
the people responsible for the router's software should be told that
this is not particularly useful....)  Or is *some* kind of indication of
the link layer provided.