ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] Seeing Preamble in Decodes

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 29 Mar 2007 14:48:51 -0700

On Mar 29, 2007, at 12:18 AM, Gross, Pete wrote:

I was able to figure out that for some reason the hardware was attaching its
own preamble

I think it's almost always the job of the hardware to attach the preamble.

Now, if by "preamble" you mean, for example, the 14-byte Ethernet header, that's a different matter; that's not the "preamble" in Ethernet. That's usually attached by the software, although if the adapter directly supports VLANs it might take your packet, strip off the Ethernet header, use the destination and source addresses of that header and the VLAN Ethertype to make a new 14-byte Ethernet header, and put the type field from the Ethernet header into a VLAN header.