Re: Nettl HP-UX

[Kevin Cullimore <kcullimo () runbox com>]

On 6/28/2011 4:57 PM, Chris Maynard wrote:
> Guy Harris<guy@...>  writes:
>
> > maxValidFrame is 1500.  (And, yes, this means that values of the length/type
> field between 1501 and 1535
> > are, apparently, illegal.)
> So how should Wireshark handle such invalid frames?  As a simple test, I
> manually modified an IEEE 802.3 Ethernet packet and changed its length from 38
> bytes (with 8 bytes of trailer) to 1501 bytes.  Wireshark displayed it as an
> Ethernet II frame of "Type: unknown (0x05dd)" and payload of 46 bytes.  But if
> 1501-1535 are invalid, maybe at the very least an Expert Info should be added to
> report it?
At the very least, it would prove extremely useful if Wireshark could 
distinguish between legitimate 802.1q frames and packets that contain 
too many bytes without a sufficient excuse.
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list<wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>               mailto:wireshark-users-request () wireshark org?subject=unsubscribe

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request () wireshark org?subject=unsubscribe