Wireshark mailing list archives

Force Wireshark to decode part of Data as another protocol


From: Rayne <hjazz6 () ymail com>
Date: Mon, 21 Jul 2014 23:15:29 -0700

Hi all,

I have some traffic samples where the Layer 2 is PPP and the next protocol field value is 0x0281, which indicates MPLS 
Unicast. There are 4 bytes following this PPP 
header before I see the IP header. However, Wireshark has decoded 
everything after the PPP header as Data. I can't choose the "Decode As" 
option in this case, as it is greyed out. How can I force Wireshark to decode the 4 bytes 
after the PPP header as something else, say MPLS in this case?

Thank you.
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe

Current thread: