Hi,
I'm looking at some traffic in our LAN, and think I have some problems with
Ethernet II vs 802.3 framing.
Wireshark shows lots of Ethernet II frames with "unknown" frame type 0x05ec
(=1516 decimal). Since that is less than 0x0600, the limit for Ethernet
frames, shouldn't Wireshark interpret this as an 802.3 frame rather than
Ethernet II?
In fact the frames have a payload of precisely 1516 bytes, so it seems that
it is indeed a regular 802.3 frame.
Incidentally the strange frames are all sent from a Netgear wireless router
to some MacOS X laptops, over a WEP-protected 802.11 network.
Regards,
Marcus
