Home page logo

wireshark logo Wireshark mailing list archives

Re: Change of decoding for Airopeek/Omnipeek 802.11 header with Cisco APs
From: Guy Harris <guy () alum mit edu>
Date: Fri, 20 Dec 2013 01:10:35 -0800

On Dec 20, 2013, at 12:03 AM, Alexis La Goutte <alexis.lagoutte () gmail com> wrote:

Do you have a packet of Joerg ?

No, but I asked Joerg if he still has one.

Because in the screenshot, there is "Magic Value" may be the value is different....

It might be, but I wouldn't be surprised to find that the magic number is the same (in which case we can make this a 
heuristic dissector, so you don't have to specify the port number).

*If* the magic numbers are the same, the header version is different in the two versions, and the header length is 20 
in Joerg's captures, *then* they share a common header, and the header length is *probably* fixed for each version.

(there is also a type field may be the other field is different if type have other value)

Or maybe the type field isn't even present in the other version.
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]