This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Image of the packet trace -> http://postimage.org/image/984jj38/

This is also happens with Auth packets the client -> AP packet has a timestamp which occurs after the AP -> client Auth packet

Does anyone know whats going on? is it a bug in the driver?

asked 16 Oct '11, 11:08

ddayan's gravatar image

ddayan
41151720
accept rate: 0%

edited 16 Oct '11, 13:21

Do the frames contain the same Association ID?
http://www.wildpackets.com/resources/compendium/wireless_lan/wlan_packet_types/printable
http://www.wi-fiplanet.com/tutorials/article.php/1447501

(16 Oct '11, 23:31) joke
2

If this happens multiple times, your capture setup might irritate you. Buffered frames waiting to be delivered to your analyzer may change their original order - happens more often when capturing your own, local machine during its own association. In that case, just ignore is.

I would always recommend capturing wireless traffic with a second "capture only" device.

@ Joke, Association ID is assigned by the AP - NOT requested by the client. It's just a number for the wireless client to remember in case the AP later on tells e.g. "buffered packets for Assoc ID 2".

(17 Oct '11, 03:16) Landi

@Landi
You are absolutely right. Thank you.

@ddayan
Sorry for the noise.

(17 Oct '11, 08:03) joke

@Landi

I think you are right. I did captured on the same machine. Where can i get more info about the way buffered frames are delivered? I would like to know more about why the original order is changed.

(18 Oct '11, 05:11) ddayan

Good question - if you find something give me the link ;) No, honestly - that's stack internals as far as i figured that out plus the way the driver handles stuff... no idea - sorry

(18 Oct '11, 09:32) Landi

--- from comment to answer ---

If this happens multiple times, your capture setup might irritate you. Buffered frames waiting to be delivered to your analyzer may change their original order - happens more often when capturing your own, local machine during its own association. In that case, just ignore is.

I would always recommend capturing wireless traffic with a second "capture only" device.

permanent link

answered 18 Oct '11, 09:33

Landi's gravatar image

Landi
2.3k51442
accept rate: 28%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×114
×5

question asked: 16 Oct '11, 11:08

question was seen: 2,979 times

last updated: 18 Oct '11, 09:33

p​o​w​e​r​e​d by O​S​Q​A