Wireshark · Ethereal-users: Re: [Ethereal-users] Question about 802.11 presentation in AnonCVS version

[Guy Harris <guy@xxxxxxxxxx>]

> Ethereal seems to have changed the way it presents 802.11
> traffic.  Previously, it was all presented as 802.11 protocol,
> and the details of data packets were viewable only when
> one selected a data packet and looked at the decode tree.

This was due to a bug in the 802.11 dissector - it wasn't calling
sub-dissectors unless a protocol tree was being constructed.

Dissectors should *A*L*W*A*Y*S* call sub-dissectors, *regardless* of
whether a protocol tree is being constructed.  Many dissectors depend
(because they *have* to) on the first pass through a capture going
sequentially through the capture, handing all frames to all dissectors,
so they can construct enough state information to be used on subsequent
dissections.

(Furthermore, this doesn't even guarantee that no summary information in
subdissectors will ever show up in the display; if you are using a
display filter, or a read filter, or a colorization rule, the protocol
tree is constructed even on the first pass.)

> That being said, it's nice to see the decode at times as well....
> Perhaps a toggle can be added?

Perhaps, although throwing something *only* into the 802.11 dissector to
have it make the columns non-writable, and to have it save the address
fields and restore them after the sub-dissector returns, is a bit of a
hack; somebody might, for example, also want to see only TCP-layer
summary information.  A more general way of specifying at which layer
the summary decodes should stop might be called for here.