Ask Your Question
0

what is maximum frame size?

asked 2021-03-18 19:33:20 +0000

I have several AMSDU in my wifi frame. Wireshark does I display all AMSDUs when frame size exceeds 262144. Is this a limitation of Wireshark? For text2pcap, -m should allow to overwrite default of 262144. But I cannot give it a value of more than 262144. Is that a bug?

Thanks

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2021-03-18 19:44:30 +0000

Guy Harris gravatar image

I have several AMSDU in my wifi frame. Wireshark does I display all AMSDUs when frame size exceeds 262144.

"does I"? So it does display them, or it does not display them?

And are you saying that, at the link layer, you're getting Wi-Fi frames on the air larger than 262144 bytes?

Is this a limitation of Wireshark?

It's a value defined for Wireshark at compile time. The intent is to avoid, for example, having a malformed capture file that claims, for example, that a packet is large enough that allocating a buffer for it will cause (32-bit) Wireshark to run out of memory (and could even eat a large chunk of the address space, or of backing store, on 64-bit Wireshark) from causing a problem.

It can be increased (at compile time); we also have a larger value used for D-Bus messages.

edit flag offensive delete link more

Comments

It should read it does not display all AMSDUs. Thanks for the answer. You addressed the 262144 byte issue. I will rebuild image after increasing the value.

mahboobulalem gravatar imagemahboobulalem ( 2021-03-18 20:39:15 +0000 )edit

Note that the value is NOT used by the dissection code; it's only used when reading a capture file.

So, again, are you saying that, at the link layer, you're getting Wi-Fi frames on the air larger than 262144 bytes?

If not, changing that value won't help.

If so, then you'll have to keep increasing that value with each new release unless we increase it.

Guy Harris gravatar imageGuy Harris ( 2021-03-18 21:47:50 +0000 )edit

Yes, at the link layer I have frames larger than 262144

mahboobulalem gravatar imagemahboobulalem ( 2021-03-19 06:02:22 +0000 )edit

So that would be a PSDU? The biggest PSDU I see in 802.11-2016 is 4 692 480 octets, so we should perhaps just have a maximum packet size of at least 8MB, and maybe 128MB, as that's what's used for two link-layer types.

Guy Harris gravatar imageGuy Harris ( 2021-03-19 07:04:11 +0000 )edit

Yes, that's PSDU. At least 8MB is what we would need. The reason behind current 262144 is still valid and 128MB is not a good idea. Thanks.

mahboobulalem gravatar imagemahboobulalem ( 2021-03-19 19:35:32 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2021-03-18 19:33:20 +0000

Seen: 1,309 times

Last updated: Mar 18 '21