Wireshark · Ethereal-users: Re: [Ethereal-users] Weird Cisco packet?

[Guy Harris <guy@xxxxxxxxxx>]

> However, that's all I know about it.  You'll probably have to try
> searching the Web in general, or the Cisco Connection Documentation:
> 
> 	http://www.cisco.com/univercd/home/home.htm
> 
> to see if you can find anything about it.  The SNAP PID is all zeroes.

A Web search for 004096 found a patch to the Linux kernel that added the
Aironet 4500 driver.

That driver looks as if it treats a SNAP packet with 00-40-96 as the
OUI, 0000 as the PID, and the first two bytes of the payload, when
treated as a big-endian 16-bit quantity, having the upper 4 bits being
0001, as an "802.1H data packet".

However, the frame in question

	1) doesn't have the first two bytes of the payload match the
	   above

and

	2) doesn't look as if the Linux code in question would handle it
	   correctly if it did

and 802.1H doesn't discuss frames that look like that, so that doesn't
seem to help.