This matters for frames which arrived in A-MPDUs. Before:
12:35:07.726898 802.11: QoS data: 00:1e:52:f1:80:55 sap 00 > 58:94:6b:06:70:04 sap 06 I (s=85,r=85,C) len=82 After: 12:49:08.879003 802.11: QoS data: 10.197.84.33 > 10.0.1.3: icmp: echo reply Index: print-802_11.c =================================================================== RCS file: /cvs/src/usr.sbin/tcpdump/print-802_11.c,v retrieving revision 1.28 diff -u -p -r1.28 print-802_11.c --- print-802_11.c 12 Jan 2016 09:28:10 -0000 1.28 +++ print-802_11.c 31 Jan 2016 11:48:06 -0000 @@ -156,11 +156,19 @@ ieee80211_data(struct ieee80211_frame *w struct ieee80211_frame_addr4 *w4; u_int datalen; int data = !(wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_NODATA); + int hasqos = ((wh->i_fc[0] & + (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_QOS)) == + (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS)); u_char *esrc = NULL, *edst = NULL; TCHECK(*wh); - t += sizeof(struct ieee80211_frame); - datalen = len - sizeof(struct ieee80211_frame); + if (hasqos) { + t += sizeof(struct ieee80211_qosframe); + datalen = len - sizeof(struct ieee80211_qosframe); + } else { + t += sizeof(struct ieee80211_frame); + datalen = len - sizeof(struct ieee80211_frame); + } switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) { case IEEE80211_FC1_DIR_TODS: