This is our old Q&A Site. Please post any new questions and answers at

Hello - I received a trace from an outside source. When I opened it up I used the Decode As feature. As a result all the traffic was interpreted as Docsis which was fine since it was coming off a cable modem infrastructure. However, my problem now is that no matter what I capture is now always interpreted as Docsis which is nonsense. The question is how can I make my Wireshark installation revert back to normal?

asked 06 Feb '12, 09:24

gregwolf0797's gravatar image

accept rate: 0%

How was that trace captured? If it was captured from a Cisco device that puts DOCSIS frames onto an Ethernet as raw DOCSIS frames inside Ethernet framing, by a program that uses a sufficiently recent version of libpcap/WinPcap, they could have specified a link-layer header type of DOCSIS, so that Wireshark would automatically recognize it as DOCSIS traffic.

(06 Feb '12, 11:09) Guy Harris ♦♦

Method 1

Using the same Decode As dialog that you originally used, click the Clear button.

Method 2

Using menu Analyze > User Specified Decodes... > Clear. This wipes out all Decode As settings.

(works as of Wireshark 1.7.0)

permanent link

answered 06 Feb '12, 09:33

bstn's gravatar image

accept rate: 14%

Check the following settings: Preferences - Frame protocol - uncheck "treat all frames as docsis".

permanent link

answered 14 Nov '12, 04:49

wslez's gravatar image

accept rate: 0%

edited 14 Nov '12, 04:50

This saved me a lot of time. In Wireshark 2.2.7 on Mac, it is under Preferences->Advanced->frame.force_docsis_encap

(28 Jun, 15:17) IgorGanapolsky
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 06 Feb '12, 09:24

question was seen: 4,768 times

last updated: 28 Jun, 15:17

p​o​w​e​r​e​d by O​S​Q​A