Wireshark-users: Re: [Wireshark-users] bogus LLC header in UDP packet
From: Martin Pokorny <mpokorny@xxxxxxxx>
Date: Wed, 31 Jan 2007 07:32:16 -0700
Hi all,

Thanks everyone for the quick and helpful responses.

Jaap Keuter wrote:
Yep, SNA runs on top of LLC, so that is were Wireshark is going first.
Indeed disabling LLC gives you the raw data.

Yes, I ended up doing just that. However, I wasn't aware that the following ports were associated with the LLC protocol.

On Wed, 31 Jan 2007, Jeff Morriss wrote:
Are those ports assigned to LLC?
http://www.iana.org/assignments/port-numbers
says:

entextxid	12000/tcp  IBM Enterprise Extender SNA XID Exchange
entextxid	12000/udp  IBM Enterprise Extender SNA XID Exchange
entextnetwk	12001/tcp  IBM Enterprise Extender SNA COS Network Priority
entextnetwk	12001/udp  IBM Enterprise Extender SNA COS Network Priority
entexthigh	12002/tcp  IBM Enterprise Extender SNA COS High Priority
entexthigh	12002/udp  IBM Enterprise Extender SNA COS High Priority
entextmed	12003/tcp  IBM Enterprise Extender SNA COS Medium Priority
entextmed	12003/udp  IBM Enterprise Extender SNA COS Medium Priority
entextlow	12004/tcp  IBM Enterprise Extender SNA COS Low Priority
entextlow	12004/udp  IBM Enterprise Extender SNA COS Low Priority

On Tue, 30 Jan 2007, Martin Pokorny wrote:

Unless I'm totally missing something about LLC (definite
possibility)...

Truer words were never written. Sorry about the noise.

--
Martin