Wireshark · Wireshark-dev: Re: [Wireshark-dev] DOCSIS is not one of the DLTs supported by this device).

[Guy Harris <guy@xxxxxxxxxxxx>]

On Dec 4, 2009, at 8:50 PM, Scott and Germaine James wrote:

> DOCSIS is not one of the DLTs supported by this device).
>  what is this about

Is that a message that was printed when you ran tcpdump?  (The  
equivalent message in Wireshark/TShark/dumpcap is "That DLT isn't one  
of the DLTs supported by this device".)

If so, was it because you tried capturing on, for example, a Wi-Fi  
(802.11) device with "-y DOCSIS"?

If so, that's not supported.  "-y DOCSIS" is supported on Ethernet  
because some Cisco cable modem head-end equipment can put DOCSIS  
frames onto an Ethernet cable plugged into the device; what it does is  
uses the very low-level framing mechanism of Ethernet, but, instead of  
putting Ethernet frames, with a standard Ethernet header, on the  
cable, it puts DOCSIS frames on the cable.  That flag causes the link- 
layer type of the capture to be marked as DOCSIS, not Ethernet, so  
that the capture will be properly interpreted by, for example,  
Wireshark and TShark.  Cisco doesn't, as far as I know, support  
putting DOCSIS frames onto 802.11 networks in that fashion.