Wireshark · Wireshark-users: Re: [Wireshark-users] Missing packet padding bytes on Mac

[Guy Harris <guy@xxxxxxxxxxxx>]

On Nov 19, 2009, at 6:22 AM, Tatakis, Thomas (Tom) wrote:

> I was recently debugging a CDP protocol issue with version 1.2.3 on  
> a Mac platform.  The device I was debugging was adding padding bytes  
> to the packets to an 8 byte boundary.  These bytes did not show up  
> in the trace on the Mac platform.  However, when I used version  
> 1.0.3 on a PC platform, these bytes did show up as part of the trace.

So presumably you're capturing traffic from the device on both machines?

What operating system was the PC running?  If it's running Windows,  
what happens if you install version 1.2.4 (the latest 1.2.x release)  
and try capturing that traffic?  (If it's not running Windows - e.g.,  
if it's running Linux - see whether you can install some 1.2.x release  
and try that.)

What type of network is this on?  If it's Ethernet, CDP puts a length  
field, rather than a type field, in the MAC header; what is the value  
of the length field?