Re: [Ethereal-users] captute raw HDLC IP data?

[Guy Harris <guy@xxxxxxxxxx>]

> I am running Ethereal on WindowsNT.
> I am trying to capture raw Ethernet data, i.e., HDLC frames that contain
> network data while keeping the HDLC frames intact.

"Raw Ethernet data" isn't HDLC, it's Ethernet.  Ethernet packets don't
use HDLC headers; *some* 802.3/Ethernet packets include 802.2 LLC
headers, and LLC is somewhat HDLC-like, but it's not HDLC.

If you want to capture raw Ethernet data, Ethereal and WinPcap will do
that on Ethernet devices.  They will capture the entire packet,
including the Ethernet/802.3 header, as well as the payload, which, for
802.2 LLC frames, would include the 802.2 LLC header.

> Is there a documentation explaining the file format specs that
> Ethereal/WinPcap capture.

The file format it uses is libpcap format; there's no documentation I
know of for that other than the source code.