Wireshark-bugs: [Wireshark-bugs] [Bug 12526] Wireshark doesn't separate pseudoheader lengths fro

Date: Sat, 18 Jun 2016 23:26:23 +0000

Comment # 7 on bug 12526 from
(In reply to Guy Harris from comment #6)
> However, it might be nice if, for example, 802.11 packets from wiretap with
> radio metadata always had "Wireshark generic radio metadata" even if the
> metadata is part of the packet data

...but that's a "nice to have".

Perhaps, for example, transforming radio metadata could be done separately, and
implemented later.

Note also that there isn't even a guarantee that, if you subtract the length of
any radiotap header, the length of an 802.11 packet from the pcap packet
header/pcapng block header corresponds to the actual length on the wire^Wair,
because some Atheros adapters, when supplying 802.11 headers rather than "fake
Ethernet" headers, put padding in between the 802.11 header and the payload to
align the payload on a 4-byte boundary.  That's not as bad, as the worst case
makes the packet length from the capture is at most 3 bytes bigger than the
actual length on the air, but it's still a nuisance.  (That's what the 0x20 bit
in the radiotap Flags field:

    http://www.radiotap.org/defined-fields/Flags

is for.)


You are receiving this mail because:
  • You are watching all bug changes.