Wireshark-users: Re: [Wireshark-users] Capturing Giant Packets Only

From: "Sheahan, John" <John.Sheahan@xxxxxxxxxxxxx>
Date: Thu, 3 Jul 2008 13:11:55 -0400

I captured all traffic on my port-channel and filtered for ethernet.len
> 1518 and did not see any traffic yet my counters on the switch were
into the 100s of thousands. I opened a case with Cisco and they
confirmed that this is a cosmetic bug on the version of IOS that I'm
running on the 6500 and will require an upgrade to fix it.

thanks for the help on this.

john 


 

-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Guy Harris
Sent: Wednesday, July 02, 2008 1:01 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Capturing Giant Packets Only

Sheahan, John wrote:
> I just discovered that some of my trunks are clocking lots of giant 
> packets and I wanted to know if there is a way to filter just for
giants?

If giant packets are Ethernet frames > 1514 bytes (if you don't count
the FCS)/1518 bytes (if you count the FCS), a capture filter such as
"greater 1515" (confusingly, the "greater" operation in the
libpcap/WinPcap filter parser is defined to mean "greater than or equal
to") or "greater 1519", depending on whether your adapter supplies the
FCS when capturing, should work.
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
https://wireshark.org/mailman/listinfo/wireshark-users