This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have been attempting to sniff the wifi transactions between two devices using monitor mode. I am running windows 10 currently (same issues on win7 tho), with wireshark 1.12.7. I have the airPcap library from the latest acrylic wifi release. Using either of my two wifi to usb devices (rnx-g1 and zew2500p) I appear to be able to sniff the transactions, but they are all malformed. Does anyone know what would cause this, and how it can be fixed? See the image below. alt text

asked 15 Oct '15, 10:37

phillipvanoss's gravatar image

phillipvanoss
6113
accept rate: 0%

edited 16 Oct '15, 12:41

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196

Link does not work.

(15 Oct '15, 11:01) Christian_R
(15 Oct '15, 11:05) phillipvanoss

Hiding trhe details of the frame in the screenhot does not help to give you an answer!

(15 Oct '15, 11:35) Kurt Knochner ♦
1

So did you capture the trace from the image above with Wireshark or with Microsoft Network Monitor?

(15 Oct '15, 14:21) Guy Harris ♦♦

This particular capture was done with Microsoft Network Monitor and then opened in Wireshark.

(16 Oct '15, 05:48) phillipvanoss

So AirPcap is irrelevant to this, as it wasn't used to capture the traffic.

Either Microsoft or the vendors of 802.11 drivers for Windows do a really bad job of consistently providing, or not providing, the FCS for frames. If you could file a bug on the Wireshark Bugzilla for this and, ideally, attach the capture file to the bug, we might be able to try to find something in the capture file to indicate whether frames have an FCS or not. To quote a comment in the code for Network Monitor files:

             * It appears to be the case that management
             * frames (and control and extension frames ?) may
             * or may not have an FCS and data frames don't.
             * (Netmon capture files have been seen for this
             *  encapsulation having management frames either
             *  completely with or without an FCS. Also: instances have been
             *  seen where both Management and Control frames
             *  do not have an FCS).
             * An "FCS length" of -2 means "NetMon weirdness".
permanent link

answered 16 Oct '15, 12:40

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×248
×134
×86
×47
×3

question asked: 15 Oct '15, 10:37

question was seen: 2,212 times

last updated: 16 Oct '15, 12:41

p​o​w​e​r​e​d by O​S​Q​A