Wireshark-bugs: [Wireshark-bugs] [Bug 11105] New: Some Netmon "IEEE 802.11 plus Network Monitor
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 06 Apr 2015 02:05:11 +0000
Bug ID 11105
Summary Some Netmon "IEEE 802.11 plus Network Monitor radio header" captures dissected incorrectly
Product Wireshark
Version Git
Hardware All
OS Windows Server 2003
Status UNCONFIRMED
Severity Minor
Priority Low
Component Dissection engine (libwireshark)
Assignee bugzilla-admin@wireshark.org
Reporter wmeier@newsguy.com 

Build Information:

--
The issue: Management/Control frames as saved by Netmon (3.4 ?) with
encapsulation "IEEE 802.11 plus Network Monitor radio header" may or may not be
saved with an FCS.

The current code assumes that there's always an FCS for these frames.

See:

Bug #4781:  Capture file with Management/Control frames with no FCS;

Bug #5281:  Capture file with Management frames with an FCS

My Fix (in progress):  Change the code in packet-ieee80211.c related to
handling "IEEE 802.11 plus Network Monitor radio header" encapsulation to
observe the "wlan_check_fcs" preference for IEEE80211 Management & Control
frames


An aside: Some testing of the Microsoft Netmon 3.4 "wireless.npl" parser shows
that it determines the presence/absence of an FCS by noticing if there are 4
bytes left over after parsing the wireless frame. (There is some code testing
the flag "FCSPresent" but that flag is always set to FALSE).

You are receiving this mail because:
  • You are watching all bug changes.