Re: [Ethereal-users] Forcing a decode offset

[Dinesh Makhija <dinesh2@xxxxxxxxx>]

In the packet stream, first few bytes are proprietary
encapsulation and then ethernet header starts.

So, if there is a simple way to have ethereal start
looking at the  mac layer always after x number of
bytes. 

-Dinesh


--- Guy Harris <guy@xxxxxxxxxx> wrote:
> > I am using ethereal 0.8.16. Is there a way I can 
> > configure it to start decoding packets from a 
> > specific offset i.e skip the encapusaltion 
> 
> What do you mean by "start decoding packets from a
> specific offset?"
> 
> If you start decoding at, say, the offset of the
> first byte after the
> link-layer, you don't necessarily know *how* to
> dissect the data.  In
> an Ethernet packet, the protocol type field appears
> in the link layer,
> so if you start decoding after the link-layer
> header, you don't know
> what dissector should handle the rest of the packet
> (The IP or IPv6
> dissector?  The ARP dissector?  The IPX dissector? 
> The ...?).


__________________________________________________
Terrorist Attacks on U.S. - How can you help?
Donate cash, emergency relief information
http://dailynews.yahoo.com/fc/US/Emergency_Information/