This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

As you may already know, when we capture wireless frames over a WiFi interface, you can choose Monitor mode so all the radio information can be shown. If you don't choose Monitor mode, an pseudo Ethernet header will be used so that you can see all the higher level protocols, like tcp, icmp, etc.

My question is, how to convert the frames captured under monitor mode to its corresponding 'Ethernet' form?

asked 27 Mar '17, 02:33

SteveZhou's gravatar image

SteveZhou
191273034
accept rate: 0%

You can still see the information from layer 3 and above if the frames are decrypted even with the radiotap (or other) and 802.11 headers present from monitor mode.

The presence/absence of higher level protocol decoding is not linked to pseudo header vs 802.11 header.

(27 Mar '17, 03:38) Bob Jones

but I cannot see any higher level protocol, it was only shown as Data under IEEE 802.11 header. Do I need to decode that manually?

(29 Mar '17, 20:51) SteveZhou

I can only imagine two cases without looking at any tangible evidence, such as an actual trace:

A. The 802.11 type 'data' frames are encrypted. Are the frames 'protected' - i.e. have the p-bit set in the 802.11 header for these data frames?

.1.. .... = Protected flag: Data is protected

B. The Wireshark installation is broken such as decoding no longer works

For case 1, decrypt first. If this still does not work, try changing the ignore protection bit options under protocols->IEEE 802.11. For case 2, I have never seen this happen, but try a different machine and/or reinstall.

I never need to decode manually typical network traffic, i.e. ARP, basic UDP and TCP data flows, etc, that comes from wireless monitor mode.

(30 Mar '17, 03:35) Bob Jones
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×114

question asked: 27 Mar '17, 02:33

question was seen: 1,488 times

last updated: 30 Mar '17, 03:35

p​o​w​e​r​e​d by O​S​Q​A