Wireshark-commits: [Wireshark-commits] rev 54091: /trunk/epan/dissectors/ /trunk/epan/dissectors/:
http://anonsvn.wireshark.org/viewvc/viewvc.cgi?view=rev&revision=54091
User: eapache
Date: 2013/12/14 02:11 PM
Log:
From Peter Paluch via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9158
Currently, the LLC dissector in packet-llc.c displays the values of DSAP IG bit
and SSAP CR bit as separate items in the proto tree. This gives an impression
that these entries are separate fields in the LLC header while in reality, they
are only the least significant bits in DSAP/SSAP octets. In addition, the
importance of these bits is relatively low in today's LLC-based protocols (they
are mostly set to 0), so having them always displayed in the proto tree is
somewhat of a luxury.
Modify the LLC dissector by having added a subtree to both DSAP and SSAP items
that displays the IG and CR bits as bits in a bitfield, and moved the display
of IG and CR bits into these subtrees.
It may seem that adding a text item instead of a FT_UINT8 value is not a
sensible approach because such item is not filterable. However, if filtering by
the entire DSAP/SSAP value (which is the typical way of filtering on SAPs), this
value is always added to the tree in its entirety and indexed by "llc.dsap" and
"llc.ssap" filter strings. If the GI or CR bit are to be matched, "llc.dsap.ig"
and "llc.ssap.cr" filter strings are available. Searching for the value of the
DSAP/SSAP & 0xFE which would be the value currently added by the
proto_tree_add_text() is not done and should not be done, as IEEE stipulates:
"An individual actual address value does not necessarily have any relationship
with a group address of the same actual address value."
(http://standards.ieee.org/develop/regauth/tut/llc.pdf) Following this
consideration, the choice of displaying the SAP "actual address" using
proto_tree_add_text() is acceptable.
Directory: /trunk/epan/dissectors/
Changes Path Action
+61 -15 packet-llc.c Modified
