I have a capture in which every frame starts with a proprietary header followed by ethernet frame (beginning with dest MAC and source MAC). I'm trying to discard this proprietary header using DLT USER but when I try to set "ethernet" or "ethics's" as payload protocol, I get a "dissector not found" error. How can I do ?
I did some digging in the source-code and the ethernet dissector registers itself with three protocol names:
So if you already know if the enbedded ethernet frames have a FCS, you can use eth_withoutfcs or eth_withfcs. If you don't know (or if it can be a mix), then you can use eth_maybefcs as the protocol.
Instead of using a custom DLT to discard this proprietary header while showing the packets in Wireshark, you can also remove the proprietary header from the pcap file by using editcap -C <headerlength> <old.pcap> <new.pcap>
Asked: 2019-09-28 21:10:53 +0000
Seen: 1,072 times
Last updated: Sep 29 '19
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
