Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] 12 bytes before the IP header

From: Aleksander Veksler <veksler@xxxxxxxxxxxx>
Date: Fri, 7 Sep 2007 00:23:54 +0200
Hello people,

Anyone have tips on how you loose a few bytes? I get 12 bytes between the Ethernet header and IP header. This means that wireshark does not recognize the IP header as, and I can't use any of the wireshark's advanced features.

Anyone know how to get rid of those bytes, or perhaps what they are?
* My card is Intel Pro/Wireless 3945ABG
* The wireless switch is D-Link DIR-635
* The problem only happens in promiscuous mode, and only to the packets not directed to my computer
* I attach picture of a window of a sample http packet
* Please help :)


wbr, Aleksander

Attachment: packet.PNG
Description: PNG image