Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Can you share a pcap on a public file share and update the question with a link to it?
Looks like Wireshark does it's best with mesh but YMMV.


     * Does it look as if we have a mesh header?
     * For locally originated mesh frames, the QoS header may be added
     * by the hardware, and no present in wireshark captures.  This
     * poses a problem as the QoS header indicates the presence of the
     * mesh control header.
     * In addition, we have examples of mesh captures where the QoS
     * field indicates that there is no mesh control header, yet there
     * is one.
     * Instead of QoS, we use a few heuristics to determine the presence
     * of the mesh control header, which is tricky because it can have a
     * variable length. We fall back to using the QoS field if it exists
     * and the packet isn't long enough (due to truncation or something
     * malformed that should be flagged.)
     * Assume minimal length, and then correct if wrong.