diff --git a/tests/dissect-wireshark/README.md b/tests/dissect-wireshark/README.md
index 6de2a99..701f512 100644
--- a/tests/dissect-wireshark/README.md
+++ b/tests/dissect-wireshark/README.md
@@ -96,3 +96,12 @@
   packet 6.
 - data packet is properly dissected after a partial reconstruction of WebSocket
   conversation at packet 12.
+
+### 7. Ethernet
+
+Trace file: `ethernet.pcap`
+
+Trace summary: Short capture, containing an NDN interest multicasted directly in Ethernet frame.
+
+Expected result of the dissection:
+- interest packet is dissected from packet 6.
diff --git a/tests/dissect-wireshark/ethernet.pcap b/tests/dissect-wireshark/ethernet.pcap
new file mode 100644
index 0000000..f362e4f
--- /dev/null
+++ b/tests/dissect-wireshark/ethernet.pcap
Binary files differ
diff --git a/tools/dissect-wireshark/README.md b/tools/dissect-wireshark/README.md
index 6284650..02497c7 100644
--- a/tools/dissect-wireshark/README.md
+++ b/tools/dissect-wireshark/README.md
@@ -15,6 +15,8 @@
 - NDN packets are encapsulated in IPv4/IPv6 TCP/HTTP WebSocket packets with source or
   destination port 9696.
 
+- NDN packets are encapsulated in Ethernet frames with EtherType 0x8624.
+
 ## Available dissection features
 
 - When UDP packet is fragmented, the dissection is performed after the full IP reassembly.
diff --git a/tools/dissect-wireshark/ndn.lua b/tools/dissect-wireshark/ndn.lua
index 643bcb0..6872d48 100644
--- a/tools/dissect-wireshark/ndn.lua
+++ b/tools/dissect-wireshark/ndn.lua
@@ -263,13 +263,21 @@
    return block
 end
 
+function canBeValidNdnPacket(block)
+   if ((block.type == 5 or block.type == 6) and block.length <= 8800) then
+      return true
+   else
+      return false
+   end
+end
+
 function findNdnPacket(tvb)
    offset = 0
 
    while offset + 2 < tvb:len() do
       local block = getBlock(tvb, offset)
 
-      if ((block.type == 5 or block.type == 6) and block.length <= 8800) then
+      if canBeValidNdnPacket(block) then
          return block
       end
 
@@ -368,7 +376,7 @@
 
       if (nBytesLeft > 0) then
          ok, block = pcall(getBlock, tvb, tvb:len() - nBytesLeft)
-         if (not ok) then
+         if (not ok or not canBeValidNdnPacket(block)) then
             break
          end
       end
@@ -376,7 +384,7 @@
 
    pInfo.cols.protocol = tostring(pInfo.cols.protocol) .. " (" .. ndn.name .. ")"
 
-   if (nBytesLeft > 0 and block.size > nBytesLeft) then
+   if (nBytesLeft > 0 and block ~= nil and block.size ~= nil and block.size > nBytesLeft) then
       pInfo.desegment_offset = tvb:len() - nBytesLeft
 
       -- Originally, I set desegment_len to the exact lenght, but it mysteriously didn't work for TCP
@@ -396,5 +404,7 @@
 -- websocketDissectorTable:add("9696", ndn)
 websocketDissectorTable:add("1-65535", ndn)
 
--- print("ndn.lua is successfully loaded")
+local ethernetDissectorTable = DissectorTable.get("ethertype")
+ethernetDissectorTable:add(0x8624, ndn)
+
 io.stderr:write("ndn.lua is successfully loaded\n")