Pardon the badly-framed question title, I am struggling with it but could not find the best way to frame it. I have a program in which I use libpcap for dumping packets at various points in the program. Often at these points the buffer may not have the Ethernet / IP header and instead start with another protocol. When I parse the generated pcap file in Wireshark, it will by default assume the packet starts at te wire frame level. Is there any way to specify in Wireshark (or any other utility) what protocol it should read for the first byte?