Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 9236] Cannot dissect "nested" LLC/STP payload from an 802.

Date: Sun, 06 Oct 2013 19:18:10 +0000

Comment # 3 on bug 9236 from
I've just had a further play around, and I was able to make a BlackBerry
(running OS 5.0.0.681) generate the following odd LLC/SNAP(?) packet:

IEEE 802.11 Data, Flags: ..m...F.
    Type/Subtype: Data (0x20)
    Frame Control Field: 0x0822
        .... ..00 = Version: 0
        .... 10.. = Type: Data frame (2)
        0000 .... = Subtype: 0
        Flags: 0x22
            .... ..10 = DS status: Frame from DS to a STA via AP(To DS: 0 From
DS: 1) (0x02)
            .... .0.. = More Fragments: This is the last fragment
            .... 0... = Retry: Frame is not being retransmitted
            ...0 .... = PWR MGT: STA will stay up
            ..1. .... = More Data: Data is buffered for STA at AP
            .0.. .... = Protected flag: Data is not protected
            0... .... = Order flag: Not strictly ordered
    .000 0000 0000 0000 = Duration: 0 microseconds
    Receiver address: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
    Destination address: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
    Transmitter address: c4:3d:c7:bf:6f:8e (c4:3d:c7:bf:6f:8e)
    BSS Id: c4:3d:c7:bf:6f:8e (c4:3d:c7:bf:6f:8e)
    Source address: 40:6a:ab:05:b1:e2 (40:6a:ab:05:b1:e2)
    Fragment number: 0
    Sequence number: 3568
Logical-Link Control
    DSAP: SNAP (0xaa)
    IG Bit: Individual
    SSAP: SNAP (0xaa)
    CR Bit: Command
    Control field: U, func=UI (0x03)
        000. 00.. = Command: Unnumbered Information (0x00)
        .... ..11 = Frame type: Unnumbered frame (0x03)
    Organization Code: Encapsulated Ethernet (0x000000)
    Type: Unknown (0x0006)
Data (6 bytes)
    Data: 0000f5818000
    [Length: 6]

0000  00 00 12 00 2e 48 00 00 00 02 9e 09 a0 00 be 02   .....H..........
0010  00 00 08 22 00 00 ff ff ff ff ff ff c4 3d c7 bf   ...".........=..
0020  6f 8e 40 6a ab 05 b1 e2 00 df aa aa 03 00 00 00   o.@j............
0030  00 06 00 00 f5 81 80 00                           ........

I'm assuming that the cause, and proprietary extensions/spec abuse are
different in that case, though...


You are receiving this mail because:
  • You are watching all bug changes.