[ILUG] Network Analysis software for examining headers?

[Chris Higgins]

On Tue, 15 Feb 2005 15:50:10 -0000 (GMT)
"Conor Wynne" <weeboy at conorwynne.com> wrote:

> > On Tue, 15 Feb 2005 15:26:07 -0000 (GMT)
> > "Conor Wynne" <weeboy at conorwynne.com> wrote:
> >
> >> Hi all,
> >>
> >> I'm in search of a network analysis tool to look at the headers of
> >> network packets.
> >>
> >> I checked out ethereal, and sadly it falls short of the job.
> >
> > Huh ? What packet types are you trying to look at if ethereal
> > isn't doing it for you ?
> 
> I need to know what the "real" length of the preamble. It should be
> 64bits, but some vendors do not follow the specifications
> (apparently).

Ahh... Ok ..  That info is not likely to get past the network card itself.
Also - there is no guarantee that your network card will see all of the
preamble ( which is why it's there )... if your network card is otherwise
occupied then it may miss the first couple of bits of the preamble.. and it's
spending it's time using the preamble to synchronise on the incoming signal
rather than reading it as data.. so it's not really 'data' as such. 

The preamble is just 1010101010101010 for 7 octets, followed by the start
of frame designator which is 10101011 as the 8th octet ( that final change 
from (10)+ to 11 identifies the start of the frame ).

I don't know that anything passed up from the network driver will include
or even consider the preamble... so you may have to get down below the
network driver ( or look for hardware that will pull the electrical signal off
the wire itself )

Have you considered licking the end of the cable and counting the bits by hand ? :-)




> 
> I cannot tell this with ethereal.
> 
> > --
> > Chris Higgins
> > Darach Technology Ltd                      tel: +353-1-6204370
> 
> regards
> Conor.


-- 
Chris Higgins                              
Darach Technology Ltd                      tel: +353-1-6204370
email: chris.higgins at darach.ie          fax: +353-1-6204371
http://www.darach.ie