Wireshark · Wireshark-users: Re: [Wireshark-users] Wireshark miss reporting 802.1ad tpid as 0x8100 instead of 0x88a8

[Uday Kumar <udaykumar.ravulakollu@xxxxxxxxx>]

Sorry i didnt respond. I am using tcpdump in centos7 with Linux kernel version 3.10.0-123.e17.x86_64.  If I use spirant packet gen to capture its capturing properly. I am not understanding whether bug is in kernel or libpcap. My scenario is I am sending 1ad traffic from packet gen first port(machine1) to another machine running virtual switch. I should receive the same packet in packetgen second port

On Aug 21, 2015 12:55 AM, "Guy Harris" <guy@xxxxxxxxxxxx> wrote:

On Aug 20, 2015, at 12:14 AM, Uday Kumar <udaykumar.ravulakollu@xxxxxxxxx> wrote:

> I am capturing 802.1ad  traffic using wireshark..but 1ad tpid is miss reported. Some one let me know how to overcome this.

Wireshark's probably just showing what's in the capture.

On what OS are you capturing, and what's the full version information from Help -> About Wireshark?  The network adapter, its driver, or the OS networking stack might be changing the TPID before the packet is seen by Wireshark, or libpcap might not be correctly trying to undo those changes before handing them to the application.
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe