From f4392340d6ff2b6956423e3d6a293811aa413a7f Mon Sep 17 00:00:00 2001 From: AndersBroman Date: Tue, 2 Oct 2018 16:59:58 +0200 Subject: [PATCH] llc.c: Check ethertype 0x88DC and call the ethertype dissector. Bug: 13766 Change-Id: I9e3527cd1a535e08b547925a0f2606da25520386 Reviewed-on: https://code.wireshark.org/review/29982 Petri-Dish: Anders Broman Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman --- epan/dissectors/packet-llc.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/epan/dissectors/packet-llc.c b/epan/dissectors/packet-llc.c index 36a8db18c4..3088d8a3a3 100644 --- a/epan/dissectors/packet-llc.c +++ b/epan/dissectors/packet-llc.c @@ -381,7 +381,7 @@ dissect_llc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_) proto_tree *field_tree; proto_item *ti, *sap_item; int is_snap; - guint16 control; + guint16 control, etype; int llc_header_len; guint8 dsap, ssap, format; tvbuff_t *next_tvb; @@ -389,10 +389,26 @@ dissect_llc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_) col_set_str(pinfo->cinfo, COL_PROTOCOL, "LLC"); col_clear(pinfo->cinfo, COL_INFO); + /* IEEE 1609.3 Ch 5.2.1 + * The LLC sublayer header consists solely of a 2-octet field + * that contains an EtherType that identifies the higher layer protocol... + * Check for 0x86DD too? + */ + etype = tvb_get_ntohs(tvb, 0); + dsap = tvb_get_guint8(tvb, 0); ti = proto_tree_add_item(tree, proto_llc, tvb, 0, -1, ENC_NA); llc_tree = proto_item_add_subtree(ti, ett_llc); + if (etype == 0x88DC) { + proto_tree_add_item(llc_tree, hf_llc_type, tvb, 0, 2, ENC_BIG_ENDIAN); + next_tvb = tvb_new_subset_remaining(tvb, 2); + if (!dissector_try_uint(ethertype_subdissector_table, + etype, next_tvb, pinfo, tree)) + call_data_dissector(next_tvb, pinfo, tree); + return tvb_captured_length(tvb); + } + sap_item = proto_tree_add_item(llc_tree, hf_llc_dsap, tvb, 0, 1, ENC_BIG_ENDIAN); field_tree = proto_item_add_subtree(sap_item, ett_llc_dsap); proto_tree_add_item(field_tree, hf_llc_dsap_sap, tvb, 0, 1, ENC_BIG_ENDIAN);