This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Who has a capture containing a packet with IEEE 802.3 Raw?

0

I need to get this type of frame. If somebody captures it, please, send it to me.

asked 25 Jun '13, 04:37

DariaS's gravatar image

DariaS
11336
accept rate: 0%

edited 26 Jun '13, 05:30

grahamb's gravatar image

grahamb ♦
19.8k330206

1

For those unfamiliar with it, "802.3 Raw" means "the really old mechanism Netware used to send Netware packets directly over 802.3 Ethernet, without an Ethernet type value and without an 802.2 header". You're unlikely to see that on a modern network. See Ethernet Frame Types: Don Provan's Definitive Answer for more than you ever wanted to know about Ethernet frame types and the history thereof; the Wireshark term "IEEE 802.3 Raw" is "Ethernet_802.3" in Don's paper.

(Note also that current versions of IEEE 802.3 include both "Ethernet_II" and "Ethernet_802.2", to use Don's terminology.)

(25 Jun '13, 18:17) Guy Harris ♦♦

I know that Raw can only carry IPX packets. And that Novell IPX isn't used in our days I know too. But may be somebody picked up the kernel of IPX protocol and got this type of packet. I caught it on Windows Server 2003. But it was only one packet and it's not enough for me.

(26 Jun '13, 00:49) DariaS

One Answer:

3

I found one in the Wireshark menagerie, ipx2.cap, and uploaded it to cloudshark, since I'm not sure how to find out which bug it might have been attached to or which mailing it came from. It just contains EIGRP packets though, so I'm not sure how useful it will be to you. (Since it only contains EIGRP packets, I felt it was safe to upload it to cloudshark, since there's no real sensitive data in it, so I can be reasonably assured that it wasn't posted to a bug report and marked as private.)

You can view and/or download it from: http://cloudshark.org/captures/2b92f86afbd1.

answered 26 Jun '13, 08:17

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

Thank you very much. It's very usefull.

(26 Jun '13, 13:53) DariaS