This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Why Wiresharks shows protocol UNKNOWN and WTAP_ENCAP=1 for all packets?

0

alt text

asked 21 Jun '16, 21:58

Andrew%20Frater's gravatar image

Andrew Frater
6112
accept rate: 0%

edited 22 Jun '16, 22:23

sindy's gravatar image

sindy
6.0k4851

Each post should have a clear, specific question in the title field. Please rephrase the title as a proper question.

(21 Jun '16, 23:07) Jaap ♦

Or, in another words, from what you've provided we can only guess what is your problem. E.g. my guess is that you have disabled the ethernet dissector, but as you have provided a screenshot instead of a capture file, and you show frame 1 in the lower two panes but other frames in the packet list pane, it is not more than a guess.

(22 Jun '16, 04:25) sindy

One Answer:

0

You have deactivated Ethernet dissector.

Go to Analyze -> Enabled Protocols and ensure that Ethernet is checked (you might also need to check any other deactivated dissector you might need).

answered 22 Jun '16, 04:18

Pascal%20Quantin's gravatar image

Pascal Quantin
5.5k1060
accept rate: 30%

Thank you, Problem solved, I was unaware that asking a question was done wrong. This is the first time i have done this my bad to all those i seemed to upset? again though much thanks on my side.

(22 Jun '16, 15:20) Andrew Frater

The idea of the site is to build a Q&A knowledge base. Given the total number of questions, it can only be useful if not only the Answers are useful but also the Questions can be searched through on keywords and tags, so that other people coming with the same problem can find a similar Question already answered (and that Google search takes them to the right Question).

For the same purpose, if an Answer was useful to you, please mark it as such by clicking the checkmark icon next to it. Questions with useful Answers appear in different colour in the list so people coming with the same problem can immediately see whether the Answer was useful. No one else than you can do that - all the others may vote for the Answers but that doesn't make the Question change colour in the list.

So I've changed the title of your question to one I deem useful. I've also converted your last post from an Answer (which it was not because it did not answer your original Question) into a Comment to @Pascal Quantin's Answer. But no one else than you can mark Pascal's Answer as useful.

(22 Jun '16, 22:38) sindy

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

Like @sindy said this is a Q&A knowledge base, not a general user forum. Therefore certain constraints apply and format required.

(23 Jun '16, 00:35) Jaap ♦