Wireshark · Ethereal-users: Re: [Ethereal-users] Re: [WinPcap] Windows XP Short Frame Problem

[Guy Harris <guy@xxxxxxxxxx>]

On Fri, Feb 15, 2002 at 09:18:40AM +1000, Corey Wallis wrote:
> I have not got the built in firewall active, nor do I have any other
> type of firewall software running.  I always get 14 frames, no matter
> how many frames or bytes are on the network.  For example if there were
> 62 frames that made up the packet, I only get 14 of them.

Presumably by "frame" you mean "byte".  I.e., each Ethernet packet you
get always has 14 bytes, which is the length of the Ethernet header.

This is probably because some piece of software below the WinPcap driver
is discarding everything but the link-layer header before the packet
gets handed to WinPcap.

I have no idea what that piece of software might be, nor do I have any
idea how to find that out.  There might be something in the control
panel to let you see what all the bindings are in the Windows networking
stack, which might indicate what pieces of software would see the
Ethernet packets before they get passed to WinPcap, but I have never
seen a Windows XP system, so I don't know where that would be in the
control panel (or somewhere else in the GUI).