Wireshark · Ethereal-users: Re: [Ethereal-users] DOCSIS filter

[Guy Harris <gharris@xxxxxxxxx>]

Chen, Daniel wrote:

> I have some questions in using Ethereal to capture DOCSIS packet. 
>
> I am taking DOCSIS packets from my modem and packing it into Ethernet 
> packet to send out the Ethernet and have it captured by the Ethereal.

When capturing DOCSIS packets, libpcap and Ethereal expect that the 
frames being transmitted will contain DOCSIS packet, with *NO* Ethernet 
header - no Ethernet destination address, no Ethernet source address, 
and no type/length field.  That's what Cisco's Cable Modem Termination 
System does.

In addition, either

	1) you will need to have Ethereal use the current CVS or the 0.9 alpha 
version of libpcap, and you will have to select a link-layer type of 
"DOCSIS" when capturing

or

	2) you will have to turn on the "Treat all frames as DOCSIS frames" 
option for the "Frame" protocol

in order for the packets to be recognized as DOCSIS frames.