I can capture 802.15.4 frames containing IPv6 packets in RFC4944 format using TIs CC2531 hardware and their SmartRF sniffer. I've been able to convert them to PCAP format such that wireshark can decode the 802.15.4 headers, but I'm not able to get it to decode the IPv6 packet contents. I know that Wireshark supports RFC4944. I see it work fine with the example captures on http://wiki.wireshark.org/IEEE_802.15.4. Does my PCAP need something 'special' to get wireshark to recognize it as IPv6 data? Could it be because of the "Bad FCS"? (The sniffer unfortunately ruins the FCS) The capture file is here: http://www.cloudshark.org/captures/65a478336de3 asked 28 Apr '13, 00:17  hideo edited 28 Apr '13, 00:24 |
2 Answers:
I could get Wireshark to decode it a little further by changing the data link type in the PCAP global header, from 0xC3 (195) to 0xE6 (230). I do not really understand what is happening though. Here is the modified file: https://www.cloudshark.org/captures/46a9a369e6a9 answered 12 Nov '14, 12:57  bbc |
What should I do to change the data link type in PCP global header? answered 16 Sep '16, 04:40  ketan |
