Wireshark · Wireshark-users: Re: [Wireshark-users] Capturing Giant Packets Only

["Chad Dailey" <wireshark@xxxxxxxxxxxxxxxxxxx>]

John--

VLAN tagged frames of 1518 bytes will actually be 1522 bytes, which according to SNMP / RMON counters will be giants...

On Thu, Jul 3, 2008 at 12:11 PM, Sheahan, John <John.Sheahan@xxxxxxxxxxxxx> wrote:

I captured all traffic on my port-channel and filtered for ethernet.len
> 1518 and did not see any traffic yet my counters on the switch were
into the 100s of thousands. I opened a case with Cisco and they
confirmed that this is a cosmetic bug on the version of IOS that I'm
running on the 6500 and will require an upgrade to fix it.

thanks for the help on this.

john

-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Guy Harris
Sent: Wednesday, July 02, 2008 1:01 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Capturing Giant Packets Only

Sheahan, John wrote:
> I just discovered that some of my trunks are clocking lots of giant
> packets and I wanted to know if there is a way to filter just for
giants?

If giant packets are Ethernet frames > 1514 bytes (if you don't count
the FCS)/1518 bytes (if you count the FCS), a capture filter such as
"greater 1515" (confusingly, the "greater" operation in the
libpcap/WinPcap filter parser is defined to mean "greater than or equal
to") or "greater 1519", depending on whether your adapter supplies the
FCS when capturing, should work.
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-users
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-users