Wireshark · Ethereal-dev: Re: [Ethereal-dev] LWAPP Dissector

[David Frascone <dave@xxxxxxxxxxxx>]

On Saturday, 30 Aug 2003, Guy Harris wrote:
> 
> On Friday, August 29, 2003, at 7:19 PM, David Frascone wrote:
> 
> >Ok . . I skimmed too fast . . . 1 was correct, the access router and 
> >the
> >switch both do the swapping.  They are at both ends of the 
> >conversation.
> >On the air, the bytes are correct.
> 
> So if the bytes are correct on the air, how do they show up swapped in 
> the capture?  Or does "over the wire" refer to traffic between access 
> points and stations, rather than between the access point and the 
> access router?

No, it only ends up in the tunnelled LWAPP packets from the radio.  I have
no clue why.  But, our access router has to deal with it.

> >No, it would only be over lwapp.  And, I agree that it could be a lwapp
> >only flag.  But, since it affect packets tunnelled over lwapp, and the
> >lwapp dissector just passes off to the wlan dissector, how could we 
> >pass
> >that flag down to the wlan dissector?
> 
> Add a "control field is byte-swapped" flag to 
> "dissect_ieee80211_common()", have the existing routines that call it 
> pass FALSE, and have a new dissector, "wlan_byteswapped_fc" or 
> something such as that, and have it pass TRUE for that argument.

Ok, so instead of just resubmitting the packet to the wlan dissector,
submit it directly to 802.11. . . makes sense.  Ignore the patches to
802.11 for now, I'll correct with your suggestions and re-submit.

-Dave

-- 
David Frascone

     Don't hate yourself in the morning - sleep till noon.