Wireshark · Ethereal-users: Re: [Ethereal-users] Regarding text2pcap

[Guy Harris <gharris@xxxxxxxxx>]

LEGO wrote:

> Try first with options
>   -l 127 ( 802.11 plus radiotap WLAN header )

Unlikely (but not inconceivable) if the traffic is from Linux.

>   -l 163 ( 802.11 plus AVS WLAN header )

More likely than 127 for Linux, but there's also

	-l 119 (802.11 plus Prism WLAN header)

(it's just called "DLT_PRISM_HEADER", but it's 802.11).

There's also

	-l 105 (802.11 without any radio header)

if the hex data being converted with text2pcap has just 802.11 headers 
without any radio headeers.