Wireshark · Wireshark-users: Re: [Wireshark-users] Seeing Preamble in Decodes

[Guy Harris <guy@xxxxxxxxxxxx>]

On Mar 23, 2007, at 1:34 PM, Gross, Pete wrote:

> I am just wondering why I would start seeing the preamble in some of  
> the decodes of packets, yet not in all of them?  At first I thought  
> maybe I was transmitting two preambles, but as far as I can tell I  
> am not.  I thought that the hardware would take care of the preamble  
> and this wouldn’t be seen in wireshark at all (as the preamble is  
> not seen in other decodes).  Any help or ideas on why this could  
> possibly be happening would be very helpful (and might even let me  
> stop banging my head against the wall).

What network type is this on?  Ethernet?

What type of hardware and software did you use to capture the traffic?

Can you send us an example of a capture showing this problem?

If not, can you send us a (possibly censored) example of Wireshark/ 
TShark displaying the preamble?  (Please use the "Export" menu of  
Wireshark, and export as plain text, or use "tshark -V" to produce a  
text example - you can edit the text if you don't want IP or MAC  
addresses, for example, displayed; don't send a screen shot - mail  
messages with screen shots are much bigger than mail messages with  
just text, and are slower to download especially over slower links,  
*and* they're probably harder to censor.)