Wireshark-dev: [Wireshark-dev] regarding the structure of data packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: abhinav narain <abhinavnarain10@xxxxxxxxx>
Date: Tue, 13 Mar 2012 19:20:24 -0400
Hi,
 this is the packet dump of first  40 bytes,starting from mac header.

88 41 2c 00 c4 3d c7 9d e1 44 00 19 d2 85 d1 67 c4 3d c7 9d e1 42 30 f0 00 00 2b 4f 00 20 00 00 00 00 aa aa 03 00 00 00 08 00

first four bytes are control bits and duration.

next are the mac addresses.
c4 3d c7 9d e1 44
00 19 d2 85 d1 67 
c4 3d c7 9d e1 42
seq control
30 f0

I don't understand what to get for 10 bytes following it before I can check for aa aa, the llc header values. 

tcpdump code, also increments by 26 bytes and calls llc print with packet pointer at the byte which is 26th from the start of the mac header, but I don't find it to work here as there are clearly unknown bytes before llc header can be read, which I don't know how to get meaning of.

After the 26 bytes mac header length, I had to increment the pointer by 8 bytes more to point to aa aa (LLC header) .
I don't understand what these 8 bytes are ? and how to interpret them.

I am working on OpenWrt platform and using recvfrom on a  raw socket to get the packets.

Abhinav