Wireshark-users: Re: [Wireshark-users] a question about "Raw packet data", message: No links data
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 21 May 2007 10:43:13 -0700
Alexander Bubnov wrote:


What should it be here? What would wireshark like to see here? Or in
another words what can be here instead of "No link information
available"?


Ethernet, IEEE 802.11, Token Ring, FDDI, PPP, etc.


The above mention packet keep 12( WTAP_ENCAP_RAW_IP) value for data
link type. What does mean "RAW IP"?
It means that the packet has no link-layer data - the packet begins with the IP header. 


As far as understand it means that
packet will be parsed begining at IP and it packet should not have any
data link layers, Ethernet and etc,


Yes.


but if I am rigth in this case
what does raw packet data mean?


It means we couldn't come up with a better name for it. :-)