I need to get this type of frame. If somebody captures it, please, send it to me. asked 25 Jun '13, 04:37  DariaS edited 26 Jun '13, 05:30  grahamb ♦ |
One Answer:
I found one in the Wireshark menagerie, You can view and/or download it from: http://cloudshark.org/captures/2b92f86afbd1. answered 26 Jun '13, 08:17  cmaynard ♦♦ Thank you very much. It's very usefull. (26 Jun '13, 13:53) DariaS |
For those unfamiliar with it, "802.3 Raw" means "the really old mechanism Netware used to send Netware packets directly over 802.3 Ethernet, without an Ethernet type value and without an 802.2 header". You're unlikely to see that on a modern network. See Ethernet Frame Types: Don Provan's Definitive Answer for more than you ever wanted to know about Ethernet frame types and the history thereof; the Wireshark term "IEEE 802.3 Raw" is "Ethernet_802.3" in Don's paper.
(Note also that current versions of IEEE 802.3 include both "Ethernet_II" and "Ethernet_802.2", to use Don's terminology.)
I know that Raw can only carry IPX packets. And that Novell IPX isn't used in our days I know too. But may be somebody picked up the kernel of IPX protocol and got this type of packet. I caught it on Windows Server 2003. But it was only one packet and it's not enough for me.