Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: RE: [Ethereal-users] 802.11 Initialization vector

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Richard Urwin <RUrwin@xxxxxxxxxxxxxx>
Date: Mon, 7 Apr 2003 09:39:23 +0100
> -----Original Message-----
> From: guoquan [mailto:neokc@xxxxxxxxx]
> 
> hi,
>     there's something i do not understand when 
> reading an 802.11 frame. how do you read the 
> initialization vector (IV). Ethereal output the 
> IV something like 0xaabbcc (in the middle 
> window). however, on the data window (the 
> bottom window) the IV actually reads as ccbbaa. 
> so actually which is the correct way of 
> reading, is 0xaa the first byte of the IV or is 
> 0xcc the first byte, thanks. 

Standard internet byte order is big-endian, ie the most significant byte
is transmitted first. Many processors use little endian format, ie least
significant byte first. Because protocols need to allow many different
processors to communicate, the protocol designers need to choose which
byte order to use.

Because standard TCP/IP order is big endian you can read the same number
in the middle and bottom pane for most fields. However 802.11 specifies
little endian format for everything except CRCs. So for 802.11 fields
the bytes of the numbers will be swapped between the bottom and middle
pane.

The middle pane is correct; the value of your IV is 0xaabbcc.

802.11 will transmit this as cc bb aa, and this is the order that you
will see in the bottom pane.

-- 
Richard Urwin, Software Design Engineer
Schenck Test Automation
Braemar Court, 1311b Melton Road, Syston, UK.
rurwin@xxxxxxxxxxxxx

________________________________________________________________________
This email has been scanned for all viruses by the MessageLabs SkyScan
service. For more information on a proactive anti-virus service working
around the clock, around the globe, visit http://www.messagelabs.com
________________________________________________________________________