Re: Ethernet dissector

[Guy Harris <gharris () sonic net>]

On May 23, 2021, at 8:58 AM, Antonello Tartamo <antonellotartamo () gmail com> wrote:

> The problem is that I don't have a predefined ether type as the ether type field is used as length field.

So the frames start with:

        a 6-octet Ethernet destination address;

        a 6-octet Ethernet source address;

        a 2-octet type/length field with a value <= 1500, indicating that its value is a length rather than an Ethernet 
type?

If so, what follows the type/length field?  An IEEE 802.2/ISO 8802 LLC header, with a 1-octet DSAP, a 1-octet LSAP, and 
a control field?  Or something else?
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe