 | 1 | initial version |
If the TZSP header is a constant length, you can remove it with editcap.
$ editcap.exe -C 47 ./200909_MikroTik_TZSP.pcapng ./200909_MikroTik_TZSP_chop.pcapng
The Mikrotik I tested with had a 47 byte header:
14 (eth) + 20 (IP) + 8 (UDP) + 5 (TZSP) = 47
There are many option tags available in TZSP that could make the header length variable but my test device didn't use them. YMMV.
TZSP: Ethernet
Version: 1
Type: Received packet (0)
Encapsulation: Ethernet (1)
End
Option Tag: End (1)
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.