Wireshark · Ethereal-users: [Ethereal-users] LLC frames bigger than 1500 bytes

[Noam Kedar <noam@xxxxxxxxxxxxx>]

 

 

I'm trying to convert a capture file of an ATM/AAL5 traffic to a TCP dump file (pcap).

I took the AAL5 payload (LLC/ SNAP / Ethernet II / IPv4) and encapsulated it in an Ethernet frame.

The result is a bridged LLC frame of the form: Ethernet header/ LLC / SNAP / Ethernet II / IPv4.

 

There is a problem when the IP datagram size is 1500 bytes, since then the total payload of the base Ethernet frame is 1524 Bytes.

 

Ethertype <= 1500 (0x05DC) indicates an LLC frame, and the actual value indicates the length of the LLC frame. 

In this case the LLC frame size is greater than 1500. 

How can I indicate the payload of the Ethernet frame as an LLC when its size is greater than 1500?

Is there any Ethertype that indicates an LLC frame and would be recognized by Ethereral? (Ethereal does not recognize the EtherType 0x0002 of LLC)

 

Is there another encapsulation method that I can use?

 

Thanks,

Noam Keidar