Wireshark · Ethereal-dev: Re: [ethereal-dev] vlan updates and filtered capture

[Guy Harris <gharris@xxxxxxxxxxxx>]

> I applied those vlan updates (and committed, since it did a better job 
> than what was in there already), but it still seems to not decode 
> everything. 

That's because nobody'd written code to handle SNAP packets with an OUI
of 08-00-07.

That OUI belongs to Apple, and my copy of *Inside AppleTalk(R), Second
Edition* says:

	    SNAP protocol discriminators used by AppleTalk include
	$080007809B for AppleTalk data packets and $00000080F3 for AARP
	packets.

so the first packet in your capture, at least, looks like an AppleTalk
data packet.

Note, though, that there will probably *ALWAYS* be some chance that
Ethereal won't "decode everything", unless we write a decoder for
*every* OUI/protocol ID pair out there - and every Ethertype out there,
and every TCP and UDP port out there, and....