Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 9956] 6LoWPAN gets wrongly detected as ZGP stub NWK header

[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 7 on bug 9956 from Owen Kirby

I'm of the oppinion that a stateless heruristic dissector will always be
fundamentally broken if it has to choose between 6LoWPAN and ZGP. We could get
away with a stateless heuristic check before ZGP support was added because none
of the valid 6LoWPAN header codes would overlap with valid ZigBee command types
but that's not the case any more with the new header types in ZGP. Both
protocols are so intent on saving bytes that there was very little
consideration given to interoperability with other protocols.

The way that networks typically figure this stuff out in practice is by
associating the network type (ie: ZigBee vs. 6LoWPAN) from the IEEE 802.15.4
beacon payload, then associate that PANID with the network protocol. We might
want to look at doing something similar with the dissectors; maintain a table
of PANIDs and the associated dissector handles, we already do some similar
stuff for the mapping between short and long addresses.

...  oh how I wish IEEE 802.15.4 would have defined a protocol ID field.

---

      You are receiving this mail because:

• You are watching all bug changes.