Wireshark · Ethereal-dev: Re: [Ethereal-dev] LWAPP Dissector

[David Frascone <dave@xxxxxxxxxxxx>]

On Friday, 29 Aug 2003, Guy Harris wrote:
> Well, all three of those can't be correct - if 1) is true, then 2) 
> isn't true because the sort of traffic that has a problem doesn't exist 
> (i.e., if 1) is true, there is no LWAPP traffic between a machine that 
> byte-swaps the word and a machine that doesn't), and 3) needn't be true 
> as there's no need for the magic.

Ok . . I skimmed too fast . . . 1 was correct, the access router and the
switch both do the swapping.  They are at both ends of the conversation.
On the air, the bytes are correct.

> If 2) and/or 3) is true, then there will be bogus encapsulated 802.11 
> frames (i.e., frames with the bytes swapped) sent over LWAPP - but are 
> there any *other* places where bogus frames are sent?  If not, perhaps 
> the "fix the bogosity" preference should be an LWAPP preference, so 
> that its setting doesn't affect the dissection of regular 802.11 
> packets.

No, it would only be over lwapp.  And, I agree that it could be a lwapp
only flag.  But, since it affect packets tunnelled over lwapp, and the
lwapp dissector just passes off to the wlan dissector, how could we pass
that flag down to the wlan dissector?

-Dave

-- 
David Frascone

           Never eat anything bigger than your head.