Link-layer header type | Lucent Technologies Ethereal manual

Capturing Live Network Data

4.7. Link-layer header type

In the usual case, you won't have to choose this link-layer header type. The following paragraphs describe the exceptional cases, where selecting this type is possible, so you will have a guide what to do:

If you are capturing on an 802.11 device on some versions of BSD, this might offer a choice of "Eth- ernet" or "802.11". "Ethernet" will cause the captured packets to have fake Ethernet headers; "802.11" will cause them to have IEEE 802.11 headers. Unless the capture needs to be read by an application that doesn't support 802.11 headers, you should select "802.11".

If you are capturing on an Endace DAG card connected to a synchronous serial line, this might offer a choice of "PPP over serial" or "Cisco HDLC"; if the protocol on the serial line is PPP, select "PPP over serial", and if the protocol on the serial line is Cisco HDLC, select "Cisco HDLC".

If you are capturing on an Endace DAG card connected to an ATM network, this might offer a choice of "RFC 1483 IP-over-ATM" or "Sun raw ATM". If the only traffic being captured is RFC 1483 LLC-encapsulated IP, or if the capture needs to be read by an application that doesn't support SunATM headers, select "RFC 1483 IP-over-ATM", otherwise select "Sun raw ATM".

If you are capturing on an Ethernet device, this might offer a choice of "Ethernet" or "DOCSIS". If you are capturing traffic from a Cisco Cable Modem Termination System that is putting DOCSIS traffic onto the Ethernet to be captured, select "DOCSIS", otherwise select "Ethernet".

71

Image 85

Lucent Technologies Ethereal manual Link-layer header type

Contents

V2.0.2 16376 for Ethereal Ethereal Users Guide Ethereal Users Guide V2.0.2 16376 for Ethereal Page Table of Contents Page Page Page Foreword Preface Who should read this document? Acknowledgements About this document Where to get the latest copy of this document? Providing feedback about this document Preface Xiv Features What is Ethereal?Introduction Some intended purposes Many protocol decoders Export files for many other capture programsOpen Source Software What Ethereal is not Unix Platforms Ethereal runs onLinux Microsoft Windows Where to get Ethereal? Rose by any other name Brief history of Ethereal Development and maintenance of Ethereal FAQ Reporting problems and getting helpWebsite Wiki Mailing Lists Reporting Crashes on UNIX/Linux platforms Reporting Problems Reporting Crashes on Windows platforms Introduction Introduction Building and Installing Ethereal Download all required files Obtaining the source and binary distributions Example 2.1. Building GTK+ from source Before you build Ethereal under Unix Example 2.2. Building and installing libpcap Example 2.5. Installing debs under Debian Unix Building Ethereal from source underPage Installing from rpms under RedHat and alike Installing the binaries under UnixInstalling from debs under Debian Troubleshooting during the install on Unix Building from source under Windows Install Ethereal Installing Ethereal under Windows Install WinPcap Update WinPcap Update EtherealUninstall Ethereal Uninstall WinPcap Building and Installing Ethereal User Interface Start Ethereal Main window Main window User Interface Current program state and the captured data Menu Menu Item Accelerator Description Open File menuOpen Recent Merge Save As Menu Item Accelerator Description SaveFile Set List Files Pdml file Menu Item Accelerator Description ExportExport Selec Ted Packet Bytes Edit menu Marking packets for details User Interface View Menu View menu items View menu Seconds Since Beginning of Capture and Seconds Since Fields Time of Day, Date and Time of DayPrevious Packet are mutually exclusive Beginning Zoom Out Menu Item Accelerator Description ZoomNormal Size Resize All Go menu Menu Item Accelerator Description Last Packet Capture menu Saving filters Analyze Menu Analyze menu items Analyze menu TCP Follow Statistics menu items Statistics menu Message 225Types VoIP Calls 10. The Help Menu Help menu items Help menuPage 11. The Main toolbar Main toolbar items Main toolbar Go Forward Go BackFirst Packet Go To Last Pack Tion 9.3, Packet colorization 12. The Filter toolbar Filter toolbar 13. The Packet List pane Packet List pane 14. The Packet Details pane Packet Details pane 15. The Packet Bytes pane Packet Bytes pane 17. The initial Statusbar Statusbar User Interface Capturing Live Network Data Prerequisites Capture Options dialog box Start Capturing Packets/s Capture Interfaces dialog boxPrepare Capture frame Capture Options dialog boxInterface Link-layer header type IP addressBuffer size n megabytes Capture packets in promiscuous Stop Capture... frame Capture Files frame Display Options frame Name Resolution frameButtons Capture files and file modes Capture file mode selected by capture options Multiple files, ring buffer Multiple files, continuous Link-layer header type Example 4.2. Capturing all telnet traffic not from Filtering while capturingSrcdst host host Ether srcdst host ehost Srcdst net net mask Gateway host hostMasklen len Tcpudp srcdst port port Stop the running capture While a Capture is running Restart a running capture Using the toolbar item Capturing Live Network Data File Input / Output and Printing Open Capture File dialog box Open capture files Input File Formats Page Save Capture File As dialog box Saving captured packets Tip Output File Formats Merge with Capture File dialog box Merging capture filesPage List Files dialog box File Sets Export as Plain Text File dialog box Exporting dataExport as PostScript File dialog box Export as Psml File dialog box Export as CSV Comma Seperated Values File dialog box Export as Psml File dialog box Export as Pdml File dialog box Export Selected Packet Bytes dialog box Export selected packet bytes dialog boxPage Print dialog box Printing packetsPrinter Lpr -Pmypostscript 10. The Packet Range frame Packet Range frame 11. The Packet Format frame Packet Format frame File Input / Output and Printing Viewing packets you have captured Working with captured packets Function overview of the pop-up menus Decode As Lis Byt Menu Description TailNew Window Resolve name Copy Follow TCP Stream Mark Packet toggle Protocol Properties Filter Field ReferenceGo to Corresponding Packet Export Selected Packet Bytes Filtering on the TCP protocol Filtering packets while viewingPage Display filter fields Building display filter expressionsComparing values Display Filter comparison operators Display Filter Field Types Combining expressions Display Filter Logical Operations Common mistake Filter Expression dialog box Filter Expression dialog box Value CancelPredefined values Range Capture Filters and Display Filters dialog boxes Defining and saving filters Delete NewFilter Filter name Find Packet dialog box Finding packetsDisplay filter Hex Value Find Previous command Find Next commandDown Go to a specific packet Marking packets Packet time referencing Time display formats and time referencesPage Working with captured packets 119 Advanced Features Follow TCP stream dialog box Following TCP streamsPage Reassembling is disabled by default What is it?Packet Reassembling How Ethereal handles it Ethernet name resolution MAC layer Name ResolutionIP name resolution network layer TCP/UDP port name resolution transport layer IPX name resolution network layer Advanced Features 126 Statistics Summary window Summary windowPage Protocol Hierarchy window Protocol Hierarchy windowPage Endpoints What is an Endpoint?Endpoints window Protocol specific Endpoint List windows Conversations What is a Conversation?Conversations window Protocol specific Conversation List windows Graphs IO Graphs windowAxis Page Service Response Time DCE-RPC window Service Response TimeFibre Channel 225 RAS DCE-RPC Statistic for ... window Protocol specific statistics windows Statistics 140 Customizing Ethereal Example 9.1. Help information available from Ethereal Start Ethereal from the command lineDuration ue Filesize ue Filesizeue DurationueCapture buffer size Win32 Only Font Preference/recent settingsName resolving flags Ethereal -o mgcp.displaydissecttreeTRUE Savefile Time stamp formatCapture link type Statistics-string Coloring Rules dialog box Packet colorization Choose color dialog box Using color filters with Ethereal Control Protocol dissection Enabled Protocols dialog boxPage Decode As dialog box User Specified Decodes Decode As Show dialog box Show User Specified Decodes Preferences dialog box Preferences Customizing Ethereal 154 Customizing Ethereal 155 Table A.1. Configuration files and folders overview Appendix A. Configuration and other Files and Folders Preferences/ethereal.conf Windows folders Configuration files and folders overview. If an address is Disabledprotos Windows profiles Windows foldersPlugins folder Windows NT/2000/XP roaming profiles 98/ME with enabled user proWindows temporary folder 95/98/ME Configuration and other Files Folders 161 Appendix B. Protocols and Protocol Fields Appendix C. Related command line tools Tcpdump Capturing with tcpdump for viewing with Ethereal Tethereal Terminal-based Ethereal Example C.1. Help information available from capinfos Capinfos Print information about capture files Example C.2. Help information available from editcap Editcap Edit capture files Related command line tools Encap type Time adjustmentCapture type Snaplen Example C.3. Help information available from mergecap Mergecap Merging multiple capture files into one 171 Example C.4. Simple example of using mergecap Example C.5. Help information available for text2pcap Text2pcap Converting Ascii hexdumps to network captures Hexoct Filename Srcport destport L3pid How to use idl2eth Why do this?Prerequisites to using idl2eth Idl2eth Creating dissectors from Corba IDL files Todo Limitations Related command line tools 179 GNU General Public License Appendix D. This Documents License GPL 181 182 183 184 185