Wireshark-users: [Wireshark-users] Distinguishing Ethernet II and 802.3 frames
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Marcus Better <marcus@xxxxxxxxx>
Date: Thu, 06 Mar 2008 09:44:30 +0100
Hi,

I'm looking at some traffic in our LAN, and think I have some problems with
Ethernet II vs 802.3 framing.

Wireshark shows lots of Ethernet II frames with "unknown" frame type 0x05ec
(=1516 decimal). Since that is less than 0x0600, the limit for Ethernet
frames, shouldn't Wireshark interpret this as an 802.3 frame rather than
Ethernet II?

In fact the frames have a payload of precisely 1516 bytes, so it seems that
it is indeed a regular 802.3 frame.

Incidentally the strange frames are all sent from a Netgear wireless router
to some MacOS X laptops, over a WEP-protected 802.11 network.

Regards,

Marcus