On Fri, Jun 14, 2002 at 12:20:54AM -0700, Guy Harris wrote:
> The routines and variables whose declaration was added to
> "packet-ieee80211.h" aren't used outside "packet-ieee80211.c", so they
> should probably just be made static to "packet-ieee80211.c" and not
> added to "packet-ieee80211.h".
Fair enough.
> Dissectors aren't allowed to modify tvbuff data handed to them;
> "try_decrypt_wep()" should allocate a new buffer to hold the decrypted
> data, and return either a pointer to that buffer on success or NULL on
> failure. If it succeeds, a new tvbuff should be constructed with that
> data, and added as a new "data source" with a name such as "Decrypted
> WEP", and that tvbuff should be used when dissecting the payload. See,
> for example, "dissect_icqv5Client()" in "packet-icq.c" for an example of
> the stuff to do to set up that tvbuff.
I did it in-line because I wanted the decrypted data to show up in the
packet dump. But it should be easy enough to do things the RightWay(tm).
> The code to handle the FCS should handle "short" frames, where the
> snapshot length of the capture wasn't enough to get the FCS; for those
> frames, "tvb_length()" and "tvb_reported_length()" don't return the same
> value. See, for example, the code in "dissect_ppp_hdlc()" in
> "packet-ppp.c" for handing the PPP FCS.
If I understand correctly, tvb_length() returns the physical capture
size, while tvb_reported_length() returns the length that a higher-level
dissector tells us that we should care about.
At the 802.11 layer we have no way of knowing how long the packet is
supposed to be, as the 802.11 header doesn't specify a packet length.
Because there's no length, we have no way of knowing whether or not the
FCS is really present.
Or am I missing something? What layer would be setting the
reported_length of the tvbuff when the 802.11 dissector is the top-level
dissector in this case?
- Pizza
--
Solomon Peachy solomon@xxxxxxxxxxxxxx
AbsoluteValue Systems http://www.linux-wlan.com
715-D North Drive +1 (321) 259-0737 (office)
Melbourne, FL 32934 +1 (321) 259-0286 (fax)
Attachment:
pgph1BJH81WxT.pgp
Description: PGP signature
