The Branch Gateway’s packet sniffing service can capture also non-Ethernet packets, such as frame-relay and PPP, into the capture file. This is achieved by wrapping non-Ethernet packets in a dummy Ethernet header to allow the packets to be stored in a libpcap format. This enables you to analyze packets on all the device interfaces.
The dummy Ethernet headers are allocated according to the original packet type. Dummy Ethernet headers start with 00:00. Therefore, if the source or destination address of a packet you are viewing in Ethereal starts with 00:00, this indicates the packet is a non-Ethernet packet.
The dummy Ethernet header is identified by special MAC addresses. Packets sent from a non-Ethernet interface are identified with an SA address in the format 00:01:00:00:xx and a DA address which holds the interface index. Packets received over a non-Ethernet interface are identified with DA address in the format 00:01:00:00:xx and an SA address which holds the interface index. The show capture-dummy-headers command displays the dummy header addresses and their meaning according to the current configuration.
Note:
Ethernet packets received on a VLAN interface are identified by their VLAN tag. However, decrypted IPSec packets received on a VLAN interface are stored with a dummy header.
Gxxx-001> show capture-dummy-headers MAC Description ----------------- ---------------------------------------------------- 00:00:01:00:00:01 Decrypted IPSec packet 00:00:0a:00:0a:02 interface fastethernet 10/3 00:00:0c:a0:b0:01 interface vlan 1
