Wireshark · Ethereal-dev: Re: [Ethereal-dev] LWAPP Dissector

[Guy Harris <guy@xxxxxxxxxxxx>]

On Friday, August 29, 2003, at 7:19 PM, David Frascone wrote:

> Ok . . I skimmed too fast . . . 1 was correct, the access router and 
> the
> switch both do the swapping.  They are at both ends of the 
> conversation.
> On the air, the bytes are correct.

So if the bytes are correct on the air, how do they show up swapped in 
the capture?  Or does "over the wire" refer to traffic between access 
points and stations, rather than between the access point and the 
access router?

> No, it would only be over lwapp.  And, I agree that it could be a lwapp
> only flag.  But, since it affect packets tunnelled over lwapp, and the
> lwapp dissector just passes off to the wlan dissector, how could we 
> pass
> that flag down to the wlan dissector?

Add a "control field is byte-swapped" flag to 
"dissect_ieee80211_common()", have the existing routines that call it 
pass FALSE, and have a new dissector, "wlan_byteswapped_fc" or 
something such as that, and have it pass TRUE for that argument.