Hi,

I have this problem. To try and figure out what the problem is I have created two dumps, one over Wifi and one over 3G / HSDPA by running tcpdump on the Android device.

The Wifi dump is decoded by Wireshark no problem.

Wifi

But the 3G dump isn't very helpful.

3G / HSDPA

Does anyone know how I can get Wireshark to decode this data so I can figure out what the problem might be?

Thanks,

Ken

asked 15 Apr '12, 22:42

unclekennybobs's gravatar image

unclekennybobs
1111
accept rate: 0%

can you provide a sample trace e.g. on cloudshark with the 3g capture ?

(16 Apr '12, 06:42) Landi

Not really. It will contain private data. I'll have a look though and will update if I get a decent trace. Thanks.

(16 Apr '12, 09:54) unclekennybobs

Unfortunately, it appears that either tcpdump, libpcap, or the network software on your Android machine is buggy; the packets in the 3G capture almost certainly do NOT have an Ethernet packet header, but the capture file has a link-layer header type of "Ethernet".

Unfortunately, without seeing the capture, we can't determine what the right link-layer header type would be - or even if there currently is an appropriate link-layer header type (the set of "official" link-layer header types is on the tcpdump.org Web site). Without knowing what the link-layer header type should be, we can't figure out whether Wireshark can even decode them or, if it can, what link-layer header type should be used in Wireshark.

link

answered 16 Apr '12, 11:01

Guy%20Harris's gravatar image

Guy Harris ♦♦
7.6k11898
accept rate: 16%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×11
×8
×8
×1

Asked: 15 Apr '12, 22:42

Seen: 1,254 times

Last updated: 16 Apr '12, 11:01

powered by OSQA