Wireshark · Ethereal-users: Re: [ethereal-users] ethereal-0.8.8: frame-problem with device ippp1

[Gilbert Ramirez <gram@xxxxxxxxxx>]

On Mon, May 22, 2000 at 02:49:07PM -0500, Reinhard Nissl wrote:
> 
> 
> Hi,
> 
> if I run ethereal on device ippp1, any outgoing frame has 10 additional 
> bytes
> (e. g. 29 00 0b 00 02 00 3d 00 04 00) in front of the real ip part 
> (starting
> with 45 ...). Therefore, the ip part is interpreted wrong.

I'm not sure if this is the same, but token-ring on Linux has a similar
problem. Outgoing packets have extra bytes after the TR header
because libpcap sees the packet as its going through the protocol stack,
not as it appears on the wire. The Linux TR code created a maximum
size TR header for generated packets, then shortened the TR header
right before the packet went to the wire.

1. Is anyone else using ISDN drivers for Linux? What do they see?

2. You might want to ask the Linux ISDN developers about this. They
should be able to tell you quickly whether or not packet-mangling
is occuring in the ISDN protocol stack.

--gilbert
 
> Am I doing anything wrong, or is this a bug in ethereal?
> 
> BTW: i386 Linux, kernel 2.2.15
> 
> Bye.
> --
> Dipl.-Inform. (FH) Reinhard Nissl
> mailto:rnissl@xxxxxx