Thanks John, it did the job. I messed up the bits.
On Thu, Jan 1, 2026 at 5:36 PM John Thacker <johnthacker@xxxxxxxxx> wrote:
>
> Dario, you also flipped the "More Fragments" bit when changing the protected bit. Flip that back and it works for me, see attached.
>
> Cheers,
> John
>
> On Thu, Jan 1, 2026 at 11:26 AM Dario Lombardo <lomato@xxxxxxxxx> wrote:
>>
>> Hi Mikael, thanks for your help.
>> I've changed the protected bit when the packet is exported. Then I
>> have changed the option in the dissector to "Yes - with IV". However I
>> still can't get the ip/icmp layers dissected.
>> What am I still missing?
>>
>> On Tue, Dec 30, 2025 at 9:46 PM Mikael Kanstrup
>> <mikael.kanstrup@xxxxxxxxx> wrote:
>> >
>> > Hi Dario,
>> >
>> > The frame is said to be non-protected (wlan.fc.protected == False)
>> > making the dissector assume there's no IV following the frame header.
>> > However there seems to be one. I got this frame properly dissected by
>> > manually editing the pcap file setting wlan.fc.protected, then
>> > configuring the IEEE 802.11 dissector to ignore the protection bit
>> > with option "Yes - with IV".
>> >
>> > I guess we could introduce yet another protection bit ignore option
>> > for this "inverted" case.
>> >
>> > /Mikael
>> >
>> > Den tis 30 dec. 2025 kl 16:07 skrev Dario Lombardo <lomato@xxxxxxxxx>:
>> > >
>> > > Hello everybody
>> > > I have captured a wlan datagram on a dev board (raw data) and I have
>> > > encapsulated it in an exported pdu.
>> > > The wlan layer looks dissected fine, but the following don't. The
>> > > captured datagram should be IP+ICMP, but there is something missing in
>> > > between wlan and IP.
>> > > My question is: why aren't those dissected? Is the wlan datagram
>> > > itself missing something?
>> > > Any guidance is appreciated.
>> > > The capture is attached.
>> > > Thanks.
>> > > Dario.
>> > >
>> > > --
>> > > Naima is online.
>> > > _______________________________________________
>> > > Wireshark-dev mailing list -- wireshark-dev@xxxxxxxxxxxxx
>> > > To unsubscribe send an email to wireshark-dev-leave@xxxxxxxxxxxxx
>> > _______________________________________________
>> > Wireshark-dev mailing list -- wireshark-dev@xxxxxxxxxxxxx
>> > To unsubscribe send an email to wireshark-dev-leave@xxxxxxxxxxxxx
>>
>>
>>
>> --
>>
>> Naima is online.
>> _______________________________________________
>> Wireshark-dev mailing list -- wireshark-dev@xxxxxxxxxxxxx
>> To unsubscribe send an email to wireshark-dev-leave@xxxxxxxxxxxxx
>
> _______________________________________________
> Wireshark-dev mailing list -- wireshark-dev@xxxxxxxxxxxxx
> To unsubscribe send an email to wireshark-dev-leave@xxxxxxxxxxxxx
--
Naima is online.