Re: [Ethereal-users] IEEE 802.11 Unknown OUI problem

[joe@xxxxxxxx (Joe Tomasone)]

The protocol ID field is the same as normal - 0x0800 - IP.

The only difference from an IP packet that hasn't gone through
this bridge and one that has is that the OUI is changed.

        - Joe



> If those packets are *supposed* to have their OUI be 000078 - i.e.,
> that's some Cisco-proprietary encapsulation - then Ethereal (and, for
> that matter, tcpdump) should be made to dissect them.
>
> However, in order to do so, it must know what the protocol ID field
> value or values for those frames are, and must know what the format of
> the payload of those frames is - it can't automatically recognize them
> as IP frames without knowing what about them tags them as IP frames.