Pardon the badly-framed question title, I am struggling with it but could not find the best way to frame it. I have a program in which I use libpcap for dumping packets at various points in the program. Often at these points the buffer may not have the Ethernet / IP header and instead start with another protocol. When I parse the generated pcap file in Wireshark, it will by default assume the packet starts at te wire frame level. Is there any way to specify in Wireshark (or any other utility) what protocol it should read for the first byte?

  • Looks that your pcap file dont have the ether or ip as you mention, you can use tcpreplay.synfin.net/tcprewrite.html and add the ethernet header as you want.
    – camp0
    Apr 14 '20 at 20:15
  • Yes, that is correct. By design there are places in the code where I am constructing the packet, encapsulating it etc. So I was wondering if I can just dump at that stage itself into a pcap. For example, starting with the IPsec header. Apr 15 '20 at 6:15
  • Wireshark uses "dissectors" to tell it how to read various packet types. You can also build your own. wireshark.org/docs/wsdg_html_chunked/ChapterDissection.html Apr 15 '20 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.