Wireshark · Ethereal-users: Re: [Ethereal-users] Partial packets dump & crash

[Guy Harris <gharris@xxxxxxxxx>]

Bart Braem wrote:

> The click modular router is writing them in tcpdump format. They are
> not containing any information regarding the ethernet header...

But what's the link-layer header type value in the file header?  It 
should be DLT_RAW if the packets have only an IP header.

> It's quite easy actually: select one packet in the time-ordered list
> and select decode. In that menu change to no decoding and confirm.
> Voila, crashed.

I.e., select "Do not decode" in the "Decode As" dialog box?  Which tab 
is selected - Network, or Transport?