Wireshark · Ethereal-dev: Re: [Ethereal-dev] [PATCH] updated 802.11 dissector

[Guy Harris <gharris@xxxxxxxxx>]

On Thu, Jun 13, 2002 at 01:49:40PM -0400, Solomon Peachy wrote:
> Again, feedback welcome.

The routines and variables whose declaration was added to
"packet-ieee80211.h" aren't used outside "packet-ieee80211.c", so they
should probably just be made static to "packet-ieee80211.c" and not
added to "packet-ieee80211.h".

Dissectors aren't allowed to modify tvbuff data handed to them;
"try_decrypt_wep()" should allocate a new buffer to hold the decrypted
data, and return either a pointer to that buffer on success or NULL on
failure.  If it succeeds, a new tvbuff should be constructed with that
data, and added as a new "data source" with a name such as "Decrypted
WEP", and that tvbuff should be used when dissecting the payload.  See,
for example, "dissect_icqv5Client()" in "packet-icq.c" for an example of
the stuff to do to set up that tvbuff.

The code to handle the FCS should handle "short" frames, where the
snapshot length of the capture wasn't enough to get the FCS; for those
frames, "tvb_length()" and "tvb_reported_length()" don't return the same
value.  See, for example, the code in "dissect_ppp_hdlc()" in
"packet-ppp.c" for handing the PPP FCS.