Wireshark-bugs: [Wireshark-bugs] [Bug 8229] Need a way to treat alleged Ethernet frames as raw I
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 28 Jan 2013 22:13:26 +0000

Comment # 6 on bug 8229 from 
(In reply to comment #5)
> Created attachment 9886 [details]
> Sample capture file with missing Ethernet header.
> 
> This capture file contains a single ICMP "destination unreachable" packet,
> except there's no Ethernet header so Wireshark is unable to dissect it.

Running "editcap -T rawip -F libpcap {that capture file} {path for new capture
file}" also produces a capture file that works with Wireshark (and presumably
other libpcap-capable programs that understand DLT_RAW, e.g. tcpdump) can read.

("editcap -T rawip" does *NOT* work with the 1.8.x editcap; the resulting
pcap-ng file doesn't have the right link-layer header type for the interface. 
There are a number of problems with the current way we handle per-file
link-layer header types and per-interface information; some rearchitecting of
both libwiretap and the programs that use it, including API changes, are needed
for this and other problems.  But I digress....)

You are receiving this mail because:
  • You are watching all bug changes.