Wireshark-bugs: [Wireshark-bugs] [Bug 11318] New: wlan 802.11 packets aren't always tapped

Date: Sun, 28 Jun 2015 20:08:16 +0000
Bug ID 11318
Summary wlan 802.11 packets aren't always tapped
Product Wireshark
Version 1.12.2
Hardware x86
OS All
Status UNCONFIRMED
Severity Minor
Priority Low
Component Dissection engine (libwireshark)
Assignee [email protected]
Reporter [email protected]

Created attachment 13693 [details]
wlan packet capture

Build Information:
Version 1.12.6 (v1.12.6-0-gee1fce6 from master-1.12)

Copyright 1998-2015 Gerald Combs <[email protected]> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.17, with Cairo 1.10.2, with Pango 1.30.1, with
GLib 2.36.0, with libpcap, with libz 1.2.3, without POSIX capabilities, with
SMI
0.4.8, without c-ares, without ADNS, with Lua 5.2, without Python, with GnuTLS
2.12.19, with Gcrypt 1.5.0, with MIT Kerberos, with GeoIP, with PortAudio
V19-devel (built Jul 16 2013 19:05:52), with AirPcap.

Running on Mac OS X 10.10.3, build 14D2134 (Darwin 14.3.0), with locale .UTF-8,
with libpcap version 1.5.3 - Apple version 47, with libz 1.2.5, GnuTLS 2.12.19,
Gcrypt 1.5.0, without AirPcap.
Intel(R) Core(TM) i7-4980HQ CPU @ 2.80GHz

Built using llvm-gcc 4.2.1 (Based on Apple Inc. build 5658) (LLVM build
2336.9.00).

--
When testing a Lua script for tapping 802.11 wifi "wlan" packets, I discovered
that not all the wlan packets are being tapped - the C-code does not invoke the
listener taps (Lua nor C-code based ones) in all cases.

Looking in packet-ieee80211.c, in dissect_ieee80211_common(), there are several
situations where the function returns early, instead of going to the
"end_of_wlan:" goto label.  I'm not sure if that's intended behavior, but I
don't see why it would be.

It seems like a bug to me, but I'm not an expert in 802.11.

The attached capture file has some such packets: frame #1-21, 23, 25, 27, 29,
33-35, and more are not tapped.


You are receiving this mail because:
  • You are watching all bug changes.