> It's kind of funny the way it works-- LLC is shown as occupying 3 bytes
> in the hex dump when highlighting "Logical-Link Control" in the protocol tree.
> But when highlighting "Control Field", two bytes, one extending beyond
> the LLC byte range, is highlighted in the hex dump.
> </aside>
When "dissect_llc()" creates the top-level protocol tree item for LLC,
it does so before it looks at anything other than the SSAP and DSAP, so
it doesn't check what type of frame it is - unnumbered frames have a
3-byte LLC header (and maybe the extra SNAP stuff), but other frames
have 4-byte LLC headers as LLC frames are all extended.
I'll look into that, although it's a bit of a pain, as, whilst
"dissect_llc_control()" figures out how big the raw LLC header is, it
requires that you've already created the top-level protocol tree item so
it has something under which to stick its items; we could adjust the
length of that top-level item after calling "dissect_llc_control()".
