Wireshark-dev: Re: [Wireshark-dev] Change of decoding for Airopeek/Omnipeek 802.11 header with
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Emburey Samrex Edward -X (emedward - EMBED UR SYSTEMS at Cisco)" <emedward@xxxxxxxxx>
Date: Fri, 20 Dec 2013 14:44:41 +0000

Hi Guy, Alexis,

 

I think, I should have mentioned this earlier.

 

There does exist two different headers: a 20-byte (legacy) and a 55-byte (with additional, 802.11n support)

 

To accommodate the 802.11n header, we would need a different dissection at dissect_peekremote(), apart from the way legacy header had been dealt.

May be, we can have the ‘magic number’ as reference from the obtained hex-dump, to choose between the two dissection methods.

 

PFA the difference in dissection that omnipeek performs on a 20-byte and a 55-byte header. (compare_80211n_legacy_omnipeek.png)

I believe it helps in the classification of fields to be done at dissect_peekremote().

 

Please let me know your further queries/comments.

Once clear, I’ll go ahead to file a bug, with all these snaps & pkt captures.

 

 

Thanks and Regards,

Emburey

Attachment: compare_80211n_legacy_omnipeek.jpg
Description: compare_80211n_legacy_omnipeek.jpg