Wireshark · Ethereal-dev: Re: [Ethereal-dev] Patch for encapsulated Ethernet frames in 802.11 (2nd attempt)

[Guy Harris <gharris@xxxxxxxxx>]

On Fri, Feb 13, 2004 at 01:11:21AM +0100, Pavel Kaòkovský wrote:
> Ethereal cannot handle Ethernet frames embedded within 802.11
> frames. It sounds really wierd but it happens and was seen in the
> wild.

What devices send them?

> As there appears to be no sane way to distinguish
> encapsulated Eth. frames from LLC/SNAP I resorted to a
> generalized variant of the method used by linux-wlan-ng drivers:
> I assume I have an encapsulated Eth. frame when the bytes 0-5 of
> the payload match the destination address in the 802.11 header or
> bytes 6-11 match the source address (the current version of
> linux-wlan-ng requires both addresses to match but frames where
> only one of the addresses matched were observed [*]). To reduce the
> likelyhood of accidental matches, the first two bytes of the
> payload are checked for 0xaa (SNAP).

Should there be a preference setting to control whether to do this or
not?

> Special bonus <g>: here is a small fix for packet-prism.c
> ("Channel Time" should read "Channel"):

Checked in.