This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I can capture 802.15.4 frames containing IPv6 packets in RFC4944 format using TIs CC2531 hardware and their SmartRF sniffer. I've been able to convert them to PCAP format such that wireshark can decode the 802.15.4 headers, but I'm not able to get it to decode the IPv6 packet contents.

I know that Wireshark supports RFC4944. I see it work fine with the example captures on http://wiki.wireshark.org/IEEE_802.15.4.

Does my PCAP need something 'special' to get wireshark to recognize it as IPv6 data? Could it be because of the "Bad FCS"? (The sniffer unfortunately ruins the FCS)

The capture file is here: http://www.cloudshark.org/captures/65a478336de3

asked 28 Apr '13, 00:17

hideo's gravatar image

hideo
11113
accept rate: 0%

edited 28 Apr '13, 00:24


I could get Wireshark to decode it a little further by changing the data link type in the PCAP global header, from 0xC3 (195) to 0xE6 (230). I do not really understand what is happening though.

Here is the modified file: https://www.cloudshark.org/captures/46a9a369e6a9

permanent link

answered 12 Nov '14, 12:57

bbc's gravatar image

bbc
111
accept rate: 0%

What should I do to change the data link type in PCP global header?

permanent link

answered 16 Sep '16, 04:40

ketan's gravatar image

ketan
6112
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×51
×13
×8
×1

question asked: 28 Apr '13, 00:17

question was seen: 4,589 times

last updated: 16 Sep '16, 04:40

p​o​w​e​r​e​d by O​S​Q​A