Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] "strange" Fragmented ip packet

From: "Velissarios Lataris" <Velissarios.Lataris@xxxxxxxxxxxxxx>
Date: Mon, 14 Apr 2008 09:56:07 +0100
Hi,

>So presumably that device looks like an Ethernet to the operating 
>system.  

Wireshark sees the device's interface as a PPP/SLIP interface. The
device is connected via usb2 to the system as a dial up modem. Dial up
connections are established to a umts network.
  
>Are you capturing traffic to and from the machine on which 
>you're running Wireshark?  If so, what OS are you running on that
machine?

I'm capturing both, os is windows xp sp2. Hw is this connected to this
issue?

>Yes, that could be the problem, although I'd *expect* that if the
packet 
>weren't received correctly some checksum/CRC at the GPRS, EDGE, or UMTS

>layer would catch that, and the E220 wouldn't have supplied the packet 
>to the host in the first place.

I take it wireshark in this case is capturing what the device is sending
to the system, which could be different from what is actually coming
through the air interface and received from the e220.  So you are right
to assume that this packet shouldn't be displayed (should have been
rejected by the device) and thus this is an issue with the device. 

>It might be that the adapter or the driver is constructing a fake
Ethernet >field, and is assuming that *all* traffic is IP traffic, which
might >explain why the Ethernet protocol type field is valid.

I'm not exactly certain I understand what you mean here!

Thanks
Velissarios

T-Mobile (UK) Limited
Company Registered Number: 02382161
Registered Office Address: Hatfield Business Park, Hatfield, Hertfordshire, AL10 9BW
Registered in England and Wales
 
NOTICE AND DISCLAIMER
 
This email (including attachments) is confidential. If you are not the intended recipient, notify the sender immediately, delete this email from your system and do not disclose or use for any purpose.