Wireshark-dev: [Wireshark-dev] Functioning of FCS checkbox in IEE802.11 prot
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Emburey Samrex Edward -X (emedward - EMBED UR SYSTEMS at Cisco)" <emedward@xxxxxxxxx>
Date: Fri, 17 Oct 2014 15:25:26 +0000

Hi Team,

 

Thanks for your attention!

 

This is regd the FCS representation in the 802.11 frames.

 

Most of the Cisco APs do have the last 4-byte of FCS, which is rightly represented in the wireshark captures.

 

Whereas, in a recent AP, we do not include this 4byte FCS.

So we go for the option in ‘EditàPreferencesàProtocolàIEEE 802.11àAssume packets have FCS’

But still, wireshark treats the last 4-bytes as FCS; as a result it is shown as malformed packets.

 

Could you please let us know about this setting.

Like, would we need to make any other extra config, for the wireshark tool to not mark the pkts as malformed?

OR there is a valid bug here in this setting.

For reference I had attached the working & non-working cases of the pkt captures.

 

 

Thanks and Regards,

Emburey

 

Attachment: non_working_case.pcap
Description: non_working_case.pcap

Attachment: working_case.pcap
Description: working_case.pcap