Linux cooked-mode capture (SLL)
This is the pseudo protocol linux uses to capture from the "any" device.
When capturing from the "any" device in linux, the system won't save the real "hardware protocol" like ["Ethernet"], but this pseudo protocol instead.
XXX - BTW: Why is the abbreviation SLL?
XXX - add a brief description of SLL history
- this is a pseudo protocol, so no lower layer (the next upper layer will be IP for example)
XXX - Add example traffic here (as plain text or Ethereal screenshot).
The LLC dissector is (fully functional, partially functional, not existing, ... whatever the current state is). Also add info of additional Ethereal features where appropriate, like special statistics of this protocol.
(XXX add links to preference settings affecting how LLC is dissected).
Example capture file
XXX - Add a simple example capture file to the SampleCaptures page and link from here (see below). Keep this file short, it's also a good idea to gzip it to make it even smaller, as Ethereal can open gzipped files automatically.
A complete list of LLC display filter fields can be found in the [http://www.ethereal.com/docs/dfref/l/llc.html display filter reference]
Show only the LLC based traffic:
You cannot directly filter LLC protocols while capturing.
- add link to PROTO specification and where to find additional info on the web about it, e.g.:
[http://www.ietf.org/rfc/rfc123.txt RFC 123] The RFC title - explanation of the RFC content.