I have a project where there is a custom implemented layer 2 protocol. An engineer before me decided to use what I'm used to as the Ethertype field as a size field. For awhile this looked right because he forgot to convert to network byteorder so the size was most times interpreted as an undocumented Ethertype and packet sniffers left it alone. I went to fix it and Wireshark started interpreting our packets as LLC frames which of course involves misconstruing the data in the payload as LLC fields. Is this a failure of Wireshark or do we run the risk of other devices making this same mistake? Is there any middle ground or does using Ethertype as size always imply an LLC/SNAP packet?
Sorry if this is the wrong place, I really wasn't sure where this belonged.