Wireshark · Ethereal-dev: Re: [Ethereal-dev] PCAP undefined link type

[Guy Harris <guy@xxxxxxxxxx>]

(Same reply as my previous one, but replying to the version of your
message that had the correct subject line.)

On Wed, Mar 21, 2001 at 02:07:19PM +0100, Peter Dons Tychsen wrote:
> Is there a type in PCAP which indicates that the link type is unknown ?

No.  You *HAVE* to have *SOME* kind of link-layer header, even if it's
"no link-layer header" (i.e., DLT_RAW, which means "IP only", no IPX or
anything else).

> The problem is, that i have an undefined link on the router which can 
> be of type IPv4, IPX or maybe a third type. I cannot set a definite 
> type in the PCAP file (my output). 

Neither IPX nor IPv4 are link-layer protocols.

You haven't specified how you're going to get these packets in the first
place.  Is there some way the router can be told to provide raw packet
data?  If so, is that the mechanism you're using to get the packet data?

If so, what data does the router provide?  Just the payload above the
link-layer, with no indication of what type of packet it is?  (If so,
the people responsible for the router's software should be told that
this is not particularly useful....)  Or is *some* kind of indication of
the link layer provided.