Wireshark · Wireshark-users: Re: [Wireshark-users] Seeing Preamble in Decodes

[Guy Harris <guy@xxxxxxxxxxxx>]

On Mar 29, 2007, at 12:18 AM, Gross, Pete wrote:

> I was able to figure out that for some reason the hardware was  
> attaching its
> own preamble

I think it's almost always the job of the hardware to attach the  
preamble.

Now, if by "preamble" you mean, for example, the 14-byte Ethernet  
header, that's a different matter; that's not the "preamble" in  
Ethernet.  That's usually attached by the software, although if the  
adapter directly supports VLANs it might take your packet, strip off  
the Ethernet header, use the destination and source addresses of that  
header and the VLAN Ethertype to make a new 14-byte Ethernet header,  
and put the type field from the Ethernet header into a VLAN header.