|
Hello - I received a trace from an outside source. When I opened it up I used the Decode As feature. As a result all the traffic was interpreted as Docsis which was fine since it was coming off a cable modem infrastructure. However, my problem now is that no matter what I capture is now always interpreted as Docsis which is nonsense. The question is how can I make my Wireshark installation revert back to normal? |
|
Check the following settings: Preferences - Frame protocol - uncheck "treat all frames as docsis". |
How was that trace captured? If it was captured from a Cisco device that puts DOCSIS frames onto an Ethernet as raw DOCSIS frames inside Ethernet framing, by a program that uses a sufficiently recent version of libpcap/WinPcap, they could have specified a link-layer header type of DOCSIS, so that Wireshark would automatically recognize it as DOCSIS traffic.