Hi all, My intention is to monitor the activities between 2 wireless stations. I can successfully capture the wireless (802.11) traffic and decrypt them. Now I see a lot of LLC packets. Is it possible for Wireshark to decode such packets and give me the TCP/IP packets? Thanks ! BR, NewWireShark asked 06 Jan '13, 17:51  newwireshark |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
Can you post the capture to an accessible webpage (such as cloudshark or Google-Drive)? If you post the capture, please include the SSID and passphrase so we can decrypt the capture.
Have you selected a Data or QoS Data frame in Wireshark? If yes, you should see the following in the Packet Details pane: 1. Frame 2. Radiotap or PPI 3. IEEE 802.11 header 4. LLC 5. IP 6. TCP
The Radiotap/PPI section may be omitted depending on your wireless driver.