This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

6lowpan/IPv6 RFC4944 data on 802.15.4 frames

0

I can capture 802.15.4 frames containing IPv6 packets in RFC4944 format using TIs CC2531 hardware and their SmartRF sniffer. I've been able to convert them to PCAP format such that wireshark can decode the 802.15.4 headers, but I'm not able to get it to decode the IPv6 packet contents.

I know that Wireshark supports RFC4944. I see it work fine with the example captures on http://wiki.wireshark.org/IEEE_802.15.4.

Does my PCAP need something 'special' to get wireshark to recognize it as IPv6 data? Could it be because of the "Bad FCS"? (The sniffer unfortunately ruins the FCS)

The capture file is here: http://www.cloudshark.org/captures/65a478336de3

asked 28 Apr '13, 00:17

hideo's gravatar image

hideo
11113
accept rate: 0%

edited 28 Apr '13, 00:24


2 Answers:

0

I could get Wireshark to decode it a little further by changing the data link type in the PCAP global header, from 0xC3 (195) to 0xE6 (230). I do not really understand what is happening though.

Here is the modified file: https://www.cloudshark.org/captures/46a9a369e6a9

answered 12 Nov '14, 12:57

bbc's gravatar image

bbc
111
accept rate: 0%

0

What should I do to change the data link type in PCP global header?

answered 16 Sep '16, 04:40

ketan's gravatar image

ketan
6112
accept rate: 0%