Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Seeing Preamble in Decodes

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 27 Mar 2007 19:12:17 -0700

On Mar 23, 2007, at 1:34 PM, Gross, Pete wrote:

I am just wondering why I would start seeing the preamble in some of the decodes of packets, yet not in all of them? At first I thought maybe I was transmitting two preambles, but as far as I can tell I am not. I thought that the hardware would take care of the preamble and this wouldn’t be seen in wireshark at all (as the preamble is not seen in other decodes). Any help or ideas on why this could possibly be happening would be very helpful (and might even let me stop banging my head against the wall).

What network type is this on?  Ethernet?

What type of hardware and software did you use to capture the traffic?

Can you send us an example of a capture showing this problem?

If not, can you send us a (possibly censored) example of Wireshark/ TShark displaying the preamble? (Please use the "Export" menu of Wireshark, and export as plain text, or use "tshark -V" to produce a text example - you can edit the text if you don't want IP or MAC addresses, for example, displayed; don't send a screen shot - mail messages with screen shots are much bigger than mail messages with just text, and are slower to download especially over slower links, *and* they're probably harder to censor.)