Hi, I have this problem. To try and figure out what the problem is I have created two dumps, one over Wifi and one over 3G / HSDPA by running tcpdump on the Android device. The Wifi dump is decoded by Wireshark no problem.
But the 3G dump isn't very helpful.
Does anyone know how I can get Wireshark to decode this data so I can figure out what the problem might be? Thanks, Ken asked 15 Apr '12, 22:42  unclekennybobs |
One Answer:
Unfortunately, it appears that either tcpdump, libpcap, or the network software on your Android machine is buggy; the packets in the 3G capture almost certainly do NOT have an Ethernet packet header, but the capture file has a link-layer header type of "Ethernet". The capture appears not to have any link-layer headers - the first octet of each packet is 0x45, which strongly suggests an IPv4 header ("4" for the IP version, "5" for the header length in 4-byte units, hence 20 bytes, which is the length of an IPv4 header with no options). This is a common problem on Android - for various annoying reasons having to do, apparently, with DHCP software, some mobile-phone-network interfaces supply I've checked into the trunk of libpcap a hack to work around this by checking the interface name. Hopefully that will end up in libpcap on various Android devices and make this problem show up less often. The hack handles this the only way I know how to do so, namely to check the interface name against names known to have this problem. What was the name of the interface on which you captured the traffic? answered 16 Apr '12, 11:01  Guy Harris ♦♦ edited 21 Mar '14, 11:18 |
can you provide a sample trace e.g. on cloudshark with the 3g capture ?
Not really. It will contain private data. I'll have a look though and will update if I get a decent trace. Thanks.