osmith
/
wireshark
forked from osmocom/wireshark
1
0
Fork 0
Code Pull Requests Releases Wiki Activity

ieee80211.c: "IEEE 802.11 plus Network Monitor radio header" encap: Fix dissection 

Specifically: Management/Control frames saved by Microsoft Netmon (3.4?)
with "IEEE 802.11 plus Network Monitor radio header"  encapsulation
may or may not be saved with an FCS.

See Bug 11105.

Fix: Use "check fcs" preference to specify whether Management & Control
frames have an fcs for this encapsulation.

Change-Id: Ibd0be7b4765c2df2b959cb2234aeed027266246b
Reviewed-on: https://code.wireshark.org/review/7939
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
This commit is contained in:
Bill Meier 2015-04-05 22:11:36 -04:00 committed by Alexis La Goutte
parent 9e724f7645
commit d3f2d8ce4f
2 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
epan/dissectors/packet-ieee80211.c
View File

@ -16658,11 +16658,12 @@ dissect_ieee80211_common (tvbuff_t *tvb, packet_info *pinfo,
has_fcs = TRUE;
break;
case -2: /* Data frames have no FCS, other frames have an FCS */
case -2: /* Data frames have no FCS, other frames may have an FCS */
/* XXX: -2 currently used only in wiretap/netmon.c */
if (FCF_FRAME_TYPE (fcf) == DATA_FRAME)
has_fcs = FALSE;
else
has_fcs = TRUE;
else /* Management, Control, Extension */
has_fcs = wlan_check_fcs;
break;
default: /* Don't know - use "wlan_check_fcs" */

11
wiretap/netmon.c
View File

@ -419,9 +419,14 @@ netmon_set_pseudo_header_info(struct wtap_pkthdr *phdr, Buffer *buf)
case WTAP_ENCAP_IEEE_802_11_NETMON:
/*
* It appears to be the case that management
* frames have an FCS and data frames don't;
* I'm not sure about control frames. An
* "FCS length" of -2 means "NetMon weirdness".
* frames (and control and extension frames ?) may
* or may not have an FCS and data frames don't.
* (Netmon capture files have been seen for this
* encapsulation having management frames either
* completely with or without an FCS. Also: instances have been
* seen where both Management and Control frames
* do not have an FCS).
* An "FCS length" of -2 means "NetMon weirdness".
*/
phdr->pseudo_header.ieee_802_11.presence_flags = 0; /* radio data is in the packet data */
phdr->pseudo_header.ieee_802_11.fcs_len = -2;