Ethereal-users: Re: [Ethereal-users] IEEE 802.11 Unknown OUI problem

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Fri, 1 Jun 2001 13:53:01 -0700 (PDT)
> I am using prismdump in conjunction with Ethereal on an 802.11 WLAN.
> My problem is this - packets going through a Cisco WLAN bridge are
> having their OUI changed from the encapsulated ethernet code of 00 00 00h
> to a Cisco code of 00 00 78h.  Ethereal seems unable to do anything with
> the packets, which are definitely IP packets, leaving them as
> generic LLC frames.
> 
> Has anyone found/written a work-around for this problem?

The problem that the packets are getting their OUI changed, or the
problem that Ethereal doesn't dissect them as IP packets?

If those packets are *supposed* to have their OUI be 000078 - i.e.,
that's some Cisco-proprietary encapsulation - then Ethereal (and, for
that matter, tcpdump) should be made to dissect them.

However, in order to do so, it must know what the protocol ID field
value or values for those frames are, and must know what the format of
the payload of those frames is - it can't automatically recognize them
as IP frames without knowing what about them tags them as IP frames.