Wireshark · Ethereal-users: Re: [Ethereal-users] Ethereal and Madge-TR

[Guy Harris <guy@xxxxxxxxxx>]

> Dear Ethereal-Users,
> 
> when I try to capture token ring traffic with a Madge Smart Ringnode Mk2 
> I receive the following messages:
> 
> [root@lahmekiste /root]# ethereal
> WARNING: unsupported device type 0x320, assuming raw
> WARNING: unsupported device type 0x320, assuming raw

0x320 is 800.  That's the *new* ARPHRD_ value, ARPHRD_IEEE802_TR, for
token ring devices, in the 2.4[.x] kernel; Linux used to use
ARPHRD_IEEE802 for that.

This means either that

	1) Red Hat haven't updated libpcap to know about
	   ARPHRD_IEEE802_TR

or

	2) the libpcap that comes with your system doesn't know about
	   token ring at all.

In either case, that's a bug; complain to Red Hat.

> I assume that Ethereal isn't aware that there is token ring traffic on 
> the network and misinterprets the frames.

Correct.

It's not aware of that because libpcap isn't telling it that; libpcap is
just screwing up.

> Reading a file captured with 
> sniffer from NAI works excellent. Is there a possibility to tell 
> Ethereal that it is capturing on a token ring?

There is a possibility that libpcap could be fixed to do so; you'd
either have to get Red Hat to fix libpcap, or install the tcpdump.org
version of libpcap and build Ethereal from source to use it.

> I couldn't find anything 
> about unsupported device types in the documentation.

That's because that message comes from libpcap, not Ethereal.