Dear wireshark,
I recently noticed that decryption of downlink traffic in wireshark - Version 3.0.3 is not done properly. Even though it is marked as correct decoded in wireshark view. The uplink traffic is decrypted correctly.
I then had a look in the code (master branch) “../dissectors/packet-lorawan.c” line 795
Here, the function
decrypt_lorawan_frame_payload() which takes in an argument dir, in this case it is statically set to 0 indicating uplink traffic. This will work as long as the traffic is uplink, however in downlink this will result in an wrong decryption.
My suggestion is to use the flag “uplink” which is set to FALSE in line 753 when mac_mtype is of type downlink, as dir argument in function call decrypt_lorawan_frame_payload()
