title: Determine the layer of a packet in a pcap file created by tcpdump
body: <p>I was reading through the <a href="http://www.tcpdump.org/pcap.html" rel="nofollow">libpcap tutorial</a> and was using some captures that I want to analyze (I didn't create them myself), so I am using the offline mode.</p>
  
  <p>When applying the tutorial, nothing seemed to match. I didn't get valid MAC addresses from the ethernet frame and not even the preamble seemed to be correct. After some expirementing I fired up wireshark and noticed something odd. Each packet start with a <code>6</code>: These are not packets on the ethernet (data link) layer, they are already one layer up on the IP (network) layer (They are IPv6 packets, which is expected).</p>
  
  <p>Of course, I can now easily continue, but I am still wondering: How do I know at which layer the captured packages are? It seems there are at least two options: Saving at the data link layer and saving at the network layer. Could it also be that I receive packets on the transport layer? How do I differentiate? Must the user tell me? I'd really hate to have to guess, but seeing as wireshark gets it right, there must be a simple way to determine it.</p>