Wireshark · Ethereal-dev: Re: [Ethereal-dev] How to access low layer raw data when I decode the high layer pro tocol

["Guy Harris" <gharris@xxxxxxxxx>]

Liu Chunfang-CCL083 said:
> Does anyone know if I can access low layer raw data when I decode the high
> layer protocol, for example, when I decode some protocols above TCP, I
> need to access ETHERNET address?

There is no broad guarantee that there *is* an Ethernet address when
you're decoding a protocol above TCP - TCP runs atop IP, which is a
routable protocol, so even if you happen to send it over Ethernet on the
first hop it might be routed over PPP, for example.

As such, I'm not sure why your dissector would *need* the Ethernet
address; what are you trying to do there?