On Apr 29, 2014, at 4:28 PM, Guy Harris <guy@xxxxxxxxxxxx> wrote:
> On Apr 29, 2014, at 11:56 AM, Todd Kleinsasser <Todd.Kleinsasser@xxxxxxxx> wrote:
>
>> Hello everyone, I am having an issue where I use a gigamon gigasmart card to slice a packet and add a trailer. As far as I can tell gigasmart is doing this correctly. However, when I open a capture up in wireshark it appears wireshark is not decoding the trailer correctly.
>
> Slicing packets *and* adding trailers goes, I suspect, beyond what a heuristic can possibly manage to figure out. I suspect the only way to fix any of this is to modify Wireshark so that there is a preference to indicate whether packets have Gigamon trailers or not.
...unless what the card does is preserve the original Ethernet header and add an additional header before it with a Gigamon Ethernet type (so that the packet can be identified as having been run through the Gigamon).
And, unless the trailer (or any header also added) indicates by how much the packet has been sliced, there might have to be an *additional* preference to indicate that.
