Revision history  [back]

Add a lowercase -x to your tshark command then look at the byte after the ethernet header bytes (6 + 6 + 2 = 14) (dest, src, type).
If the type is 08 00 (IPv4) then the upper nibble of the next byte is the IP version.
The tshark error **IPv4 18 Bogus IPv4 version (13, must be 4)** is saying 13 (hex d) is not a valid version for IPv4.