Wireshark · Wireshark-users: Re: [Wireshark-users] Nettl HP-UX

[Andrej van der Zee <andrejvanderzee@xxxxxxxxx>]

>>       2) use pcap, and convert "Ethernet with nettl headers" to raw IP by discarding the nettl headers, discarding packets with a length field rather than a linktype and with Ethertypes other that 0x0800 and 0x86dd, and discarding the Ethernet header, and convert "Raw IP with nettl headers" to raw IP by discarding the nettl headers.

That sounds promising, I will go for pcap-format with raw IP
encapsulation. To start with, how do I discard nettl/Ethernet headers?
Should I use tshark and text2pcap, manually removing the headers in
ASCII, or is there a better way?

Finally, where is this for: "discarding packets with a length field
rather than a linktype"?

Thanks alot,
Andrej