All Packets Malformed in Network Monitor 802.11 capture

Question

I have been attempting to sniff the wifi transactions between two devices using monitor mode. I am running windows 10 currently (same issues on win7 tho), with wireshark 1.12.7. I have the airPcap library from the latest acrylic wifi release. Using either of my two wifi to usb devices (rnx-g1 and zew2500p) I appear to be able to sniff the transactions, but they are all malformed. Does anyone know what would cause this, and how it can be fixed? See the image below. alt text

Answer 1

So AirPcap is irrelevant to this, as it wasn't used to capture the traffic.

Either Microsoft or the vendors of 802.11 drivers for Windows do a really bad job of consistently providing, or not providing, the FCS for frames. If you could file a bug on the Wireshark Bugzilla for this and, ideally, attach the capture file to the bug, we might be able to try to find something in the capture file to indicate whether frames have an FCS or not. To quote a comment in the code for Network Monitor files:

             * It appears to be the case that management
             * frames (and control and extension frames ?) may
             * or may not have an FCS and data frames don't.
             * (Netmon capture files have been seen for this
             *  encapsulation having management frames either
             *  completely with or without an FCS. Also: instances have been
             *  seen where both Management and Control frames
             *  do not have an FCS).
             * An "FCS length" of -2 means "NetMon weirdness".