🚀 go-pugleaf

Sorry, you're misreading the packet format.  The first byte on the
second line is part of the low level encapsulation.  It indicates
whether the packet is "long" or "short" format.  For traffic between
two hosts on the same network, either one is valid.  Long is type 2,
short is type 1.  The actual DDP packet begins in the next byte.  You
have to look further down on the line to find the socket number.  I
don't have Inside Appletalk here, but I'm pretty sure the three
successive 01's indicate that it's socket 1 in both cases.  They
appear near the beginning of the second line in the first example, and
near the end in the second case.  That's because the first case is
short form and the second case is long form.