I am sending Ethernet II frames with Destination MAC address of 02:29:99:99:00:21 wireshark is decoding those as 802.3 while two-octet field after Source MAC address is 0x8902. It seems The most significant bits of destination MAC address have special functions according to the IEEE 802 specification. Hence I changed the MAC address to 00:29:99:99:00:21 but couldn't solve the issue. I changed it again to one of the previously working MAC of 00:80:99:99:99:00:21 and workrd fine. I am trying to find out the reason and appreciate your help. asked 17 Jun '14, 19:59  parisa edited 18 Jun '14, 16:16  Guy Harris ♦♦ |
One Answer:
Because they're carried over MPLS, and the default payload type for MPLS, when the MPLS dissector can't determine the payload type, is "Ethernet pseudo-wire with a control word", but, in your traffic, the MPLS traffic is "Ethernet pseudo-wire without a control word". See the bug you filed for details on how to change the default. answered 18 Jun '14, 14:18 Guy Harris ♦♦ edited 18 Jun '14, 14:19 |
Could you please file a bug about this at the Wireshark Bugzilla, and, if possible, attach a capture file (pcap, pcap-ng, etc.) that shows this problem? We probably can't figure out the problem unless we see the capture.