Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I am attempting to identify the ether type of a packet that I am receiving. The ether type ID is 608 and has no corresponding definition in Ethertype.h(libpcap 1.2.1). The majority of the packets received have an either type of 8 which again has no corresponding definition in Ethertype.h. Does anyone have any ideas of what the cause may be behind this or should I contact TCPDump with an error report.
What is the return value of
pcap_datalink()on thepcap_ton which you’re capturing?If it’s not
DLT_EN10MB(which has the value 1), your packets aren’t Ethernet packets, and you shouldn’t parse them as Ethernet packets.If it is
DLT_EN10MB, then is that hex 608 or decimal 608? If it’s decimal 608, it’s a length field rather than a type field. The same applies to 8, which is the same decimal or hex and would thus be a length value rather than a type value.