 | 1 | initial version |
Can you share a pcap on a public file share and update the question with a link to it?
Looks like Wireshark does it's best with mesh but YMMV.
/*
* Does it look as if we have a mesh header?
*
* For locally originated mesh frames, the QoS header may be added
* by the hardware, and no present in wireshark captures. This
* poses a problem as the QoS header indicates the presence of the
* mesh control header.
*
* In addition, we have examples of mesh captures where the QoS
* field indicates that there is no mesh control header, yet there
* is one.
*
* Instead of QoS, we use a few heuristics to determine the presence
* of the mesh control header, which is tricky because it can have a
* variable length. We fall back to using the QoS field if it exists
* and the packet isn't long enough (due to truncation or something
* malformed that should be flagged.)
*
* Assume minimal length, and then correct if wrong.
*/