Recently while decoding a IEEE802.11 frame using Wireshark I notice it being detected as an Aruba Management Frame. As per IEEE standard Frame Subtype value 0x0f in 802.11 Frame is a reserved value. So why does wireshark decode it as Aruba Management. Am I missing something mentioned in the standard. asked 10 Oct '13, 05:25  Nikunj |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
Could you raise a bug report including the trace with the missinterpreted frame so we can take a look at it.
I don't think it is a misinterpretation. The dissector code simply defines subtype 0x0f as "Aruba Management" frame, whereas the OP believes this should not be the case, as subtype 0x0f if not used in the standard (I did not check). I guess, the developer of the dissector figured out, that Aruba is silently using that code for their own purposes and added that information to the dissector code.