I have came across some capwap packets that seems to have two bytes of IEEE80211's frame control swapped. There seems to be a call to Please help me understand. asked 09 Aug '17, 12:38 Guy Kroizman |
One Answer:
I asked the exaxt same question here: https://ask.wireshark.org/questions/55804/capwap-80111-data-header-fcf-swapped-why Basic Answer: if 802.11 frame control is carried over CAPWAP, bytes are simply swapped. No other indicator. It's what I do in TraceWrangler now, and it works 100% so far. answered 09 Aug '17, 14:10 Jasper ♦♦ |