Ethereal-users: Re: [Ethereal-users] Layer 3+ and Layer 2 stuff also

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Justin Walker <justin@xxxxxxx>
Date: Thu, 26 Aug 2004 20:50:54 -0500

On Aug 26, 2004, at 20:02, Phani Achanta wrote:


how to pull both layer 2 and layer 3+ information on a sniff. It seems
that when we just do a tethereal –i eth0 that we just get the normal
layer3+ stuff.
I'm not sure what you mean by this. Ethereal displays what libpcap captures, which generally includes the entire frame as received by the MAC driver. For some media, there will be problems (due generally to the device handler) in getting very low-level datagrams (e.g., those generated in a wireless network to maintain the fabric).
You should be able to see the level2 stuff just by expanding (the '+' in the display of the individual packets) the corresponding entries. 

Regards,

Justin

--
Justin C. Walker, Curmudgeon-At-Large  *
Institute for General Semantics        |   If you're not confused,
                                       |   You're not paying attention
*--------------------------------------*-------------------------------*