Wireshark-dev: [Wireshark-dev] The 802.11 dissector is a big hairy ball of wax that needs to be
From: Richard Sharpe <[email protected]>
Date: Thu, 3 Jan 2019 09:05:00 -0800
Hi folks,

I am sure that most people who work on the ieee80211 dissector will
agree that it is a monster that needs taming.

It is currently more than 37,000 lines long and a number of things
that have been done in it make it hard to split it in rational ways.

Perhaps the way that the Wi-Fi community does standards also makes
things difficult, but some of the issues I see are:

1. TAGs and Extended TAGs (for IEs) have to be defined in
packet-ieee80211.c and thus are hard to split out to other files.

It would be nice if there was some way to register new tags and
extended tags with errors if you are registering an already registered

2. The IE handling code handles placing the TAG and length into the
tree, also forcing the handling of IEs into packet-ieee80211.c.

It would be better if there was a function to handle the header, that
could perhaps be passed a function pointer to handle the body so we
can spit things out.

3. It is damn hard to find fixed fields that have been implemented ...

And so on.

I am sure that others can think of further deficiencies.

It would be useful to compile a list so we can look at reworking the
Wi-Fi suite of dissectors to make them more maintainable over time.

Please respond with your thoughts.

Richard Sharpe