Ethereal-dev: Re: [Ethereal-dev] LWAPP Dissector

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 30 Aug 2003 17:06:10 -0700

On Friday, August 29, 2003, at 7:19 PM, David Frascone wrote:

Ok . . I skimmed too fast . . . 1 was correct, the access router and the switch both do the swapping. They are at both ends of the conversation.
On the air, the bytes are correct.

So if the bytes are correct on the air, how do they show up swapped in the capture? Or does "over the wire" refer to traffic between access points and stations, rather than between the access point and the access router?

No, it would only be over lwapp.  And, I agree that it could be a lwapp
only flag.  But, since it affect packets tunnelled over lwapp, and the
lwapp dissector just passes off to the wlan dissector, how could we pass
that flag down to the wlan dissector?

Add a "control field is byte-swapped" flag to "dissect_ieee80211_common()", have the existing routines that call it pass FALSE, and have a new dissector, "wlan_byteswapped_fc" or something such as that, and have it pass TRUE for that argument.