Wireshark · Wireshark-users: Re: [Wireshark-users] Nettl HP-UX

[Chris Maynard <Chris.Maynard@xxxxxxxxx>]

Guy Harris <guy@...> writes:

> > But if 1501-1535 are invalid, maybe at the very least an Expert Info should
be added to
> > report it?
> 
> Yes.
> 
> My copy of version 1 of the DEC/Intel/Xerox Ethernet spec doesn't say anything
about valid type field
> values, unless I missed it.  Perhaps version 2 does; in any case, perhaps we
should dissect frames with
> type/length fields in that range as invalid rather than as having a type *or*
length field.

OK, I committed a change so those invalid Ethernet frames will be dissected as
such, and added an expert info as well.  Not quite sure what to do in
capture_eth() though, as I'm not completely sure what that function is for;
maybe you could have a look?