[John Thacker <johnthacker@xxxxxxxxx>]

Dario, you also flipped the "More Fragments" bit when changing the protected bit. Flip that back and it works for me, see attached.

Cheers,

John

On Thu, Jan 1, 2026 at 11:26 AM Dario Lombardo <lomato@xxxxxxxxx> wrote:

Hi Mikael, thanks for your help.
I've changed the protected bit when the packet is exported. Then I
have changed the option in the dissector to "Yes - with IV". However I
still can't get the ip/icmp layers dissected.
What am I still missing?

On Tue, Dec 30, 2025 at 9:46 PM Mikael Kanstrup
<mikael.kanstrup@xxxxxxxxx> wrote:
>
> Hi Dario,
>
> The frame is said to be non-protected (wlan.fc.protected == False)
> making the dissector assume there's no IV following the frame header.
> However there seems to be one. I got this frame properly dissected by
> manually editing the pcap file setting wlan.fc.protected, then
> configuring the IEEE 802.11 dissector to ignore the protection bit
> with option "Yes - with IV".
>
> I guess we could introduce yet another protection bit ignore option
> for this "inverted" case.
>
> /Mikael
>
> Den tis 30 dec. 2025 kl 16:07 skrev Dario Lombardo <lomato@xxxxxxxxx>:
> >
> > Hello everybody
> > I have captured a wlan datagram on a dev board (raw data) and I have
> > encapsulated it in an exported pdu.
> > The wlan layer looks dissected fine, but the following don't. The
> > captured datagram should be IP+ICMP, but there is something missing in
> > between wlan and IP.
> > My question is: why aren't those dissected? Is the wlan datagram
> > itself missing something?
> > Any guidance is appreciated.
> > The capture is attached.
> > Thanks.
> > Dario.
> >
> > --
> > Naima is online.
> > _______________________________________________
> > Wireshark-dev mailing list -- wireshark-dev@xxxxxxxxxxxxx
> > To unsubscribe send an email to wireshark-dev-leave@xxxxxxxxxxxxx
> _______________________________________________
> Wireshark-dev mailing list -- wireshark-dev@xxxxxxxxxxxxx
> To unsubscribe send an email to wireshark-dev-leave@xxxxxxxxxxxxx



--

Naima is online.
_______________________________________________
Wireshark-dev mailing list -- wireshark-dev@xxxxxxxxxxxxx
To unsubscribe send an email to wireshark-dev-leave@xxxxxxxxxxxxx

Attachment: wifi-exported3.pcapng
Description: application/pcapng