Wireshark-dev: Re: [Wireshark-dev] Get "Malformed Packet" for 802.11 Beacon frames on Windows
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 11 Apr 2016 23:18:49 -0700
On Apr 11, 2016, at 10:53 PM, Yang Luo <hsluoyb@xxxxxxxxx> wrote:

> I'm not an expert of 802.11 protocols, so can anyone point out what's wrong here?

Frame 40 has an FCS, but the "FCS at end" flag in the Flags field of the radiotap header is 0, and Wireshark thus doesn't think it has an FCS at the end, and thinks it has an extra 4 bytes of payload.

Try, by default, turning that flag *on*, and then see if any packets that don't have a valid FCS don't have an FCS at all, rather than having an invalid FCS.