Avaya Media Gateway G250, Administration Manual

Page: 463 / 840

Configuring and analyzing packet sniffing
Issue 5 June 2008 463
Figure 34: Sample Ethereal screen
Identifying the interface
The G250/G350’s packet sniffing service can capture also non-Ethernet packets, such as
frame-relay and PPP, into the capture file. This is achieved by wrapping non-Ethernet packets in
a dummy Ethernet header to allow the packets to be stored in a libpcap format. This enables
you to analyze packets on all the device interfaces.
The dummy Ethernet headers are allocated according to the original packet type. Dummy
Ethernet headers start with 00:00. Therefore, if the source or destination address of a packet
you are viewing in Ethereal starts with 00:00, this indicates the packet is a non-Ethernet packet.
For example, see the highlighted destination address of the packet appearing in the middle
pane in
Figure 34 .
The dummy Ethernet header is identified by special MAC addresses. Packets sent from a
non-Ethernet interface are identified with an SA address in the format 00:01:00:00:xx and a DA
address which holds the interface index. Packets received over a non-Ethernet interface are
identified with DA address in the format 00:01:00:00:xx and an SA address which holds the
interface index. The
show capture-dummy-headers
command displays the dummy header
addresses and their meaning according to the current configuration.