Wireshark · Ethereal-users: Re: [Ethereal-users] Partial packets dump & crash

[Guy Harris <gharris@xxxxxxxxx>]

Bart Braem wrote:

> You're right currently it's DLT_EN10MB. That should be changed, right?

Yes, it should write them as DLT_RAW if they start with an IPv4 or IPv6 
header.

> I only have one tab, the link tab (which contains "Ethertype 0xc0a8
> as"). Then selecting do not decode and hitting enter/pressing ok
> crashes Ethereal.

I took a DLT_RAW capture I had and used editcap to turn it into one with 
the same packet data but with DLT_EN10MB; I couldn't reproduce the 
problem, so...

> I hope this gives you enough information, I think I know enough to
> solve the missing ethernet header in the Click sources. Don't hesitate
> to contact me regarding the crash however.

...if you can send me a stack trace, that might help.