Wireshark · Ethereal-dev: Re: [Ethereal-dev] IEEE 802.11 dissection: auth challenge bug / fragments

[Guy Harris <gharris@xxxxxxxxx>]

On Sun, Apr 14, 2002 at 10:16:08AM +0300, Jouni Malinen wrote:
> No, I just meant that the fragments would have to be reassembled to
> get full TCP stream (i.e., the parts from other than first
> fragments). I considered IP reassembly and it would seem to be
> suitable also for 802.11 fragments. However, this was the part that I
> do not know in Ethereal and someone else can probably do the changes
> with much less effort.

Well, I've done it, although it took a fair bit of effort; most of the
effort, however, was due to having to cope with reassembled frames being
handed to us with a non-zero fragment number and the "more fragments"
bit not being set.

> I attached a dump (only data frames included) of a ping request that
> is fragmented into three 802.11 frames (512 byte fragmentation
> threshold) and a reply to that ping with all data in one frame.

The code I checked in successfully reassembled the ping.

802.11 reassembly is enabled by default; if it's disabled, frames with a
non-zero fragment number are always displayed as fragments, meaning
that, in a lot of captures, just about everything will be displayed as
an 802.11 fragment.