Ethereal-users: Re: [Ethereal-users] problems sniffing Gigabit

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Fri, 26 Apr 2002 11:59:26 -0700
On Fri, Apr 26, 2002 at 02:15:01PM -0400, Michael Cirulli wrote:
> The same capture for the gigabit interface is showing for the ARP  (x'70'
> bytes)
> 
> 45 00

That looks like the beginning of an IP header.  Are you certain that
packet *is* an ARP packet, rather than an IP packet?

If that's what it is, this is probably a bug in the driver for that
particular gigabit interface; that driver may be doing something stupid
such as setting "mac.raw" in the skbuff for incoming packets to point to
the beginning of the Ethernet *payload* rather than the beginning of the
Ethernet *header*.

Try using tcpdump and, if it has the same problem, complain to whoever
maintains the driver for that interface.