Guy Harris wrote:
> (In Martijn's original capture - the 11g-bug-gw-smc.apc one - there
> were packets with CRC errors according to Ethereal - it turns out that
> a media subtype value of 1 appears to mean "802.11 with 4 bytes of 0 at
> the end" and 3 appears to mean "802.11 with 4 bytes of FCS at the end"
> - that didn't have the "CRC Error" flag set. They appeared to be
> largely duplicates of other packets; in at least two of the cases, at
> least one of the other packets had a valid CRC, and the duplicates with
> the bad CRC appeared to have bad data in them, e.g. the SSID appeared
> to be corrupt. Could these be duplicates caused by multipath problems,
> so that multiple copies of the packet arrived by different paths? In
> those two cases, the bad copies showed up after the good copies;
> perhaps the NIC keeps track of received packets, e.g. remembering
> sequence numbers and perhaps addresses and, if it sees a duplicate
> packet, supplies it to the host, at least in monitor mode, but doesn't
> bother to checksum it - and doesn't supply any "probably multipath"
> indicator?)
I have no idea about why some packets seems to be corrupt.
My experience with 802.11 is very limited so far.
Maybe Martijn knowns more about under what circumstances the capture was
done.
Regarding the difference between "media subtype 1" and "media subtype 3" you
may be correct
that the difference is if FCS is included or not. It seems that the captures
I have with media type 1
are with FCS octets set to 00 00 00 00 and Airopeek shows a calculated value
for FCS for those
files.
However if I change the value for "media subtype" in a file I don't see any
difference.
Independently of the value for media subtype Airopeek seems to display the
FCS value if it is non-zero
(e.g. "FCS: 0x55A7E35C", or "FCS: 0x77DD110011 FCS Invalid, should be
0x342543423" )
and shows a calculated value if the FCS is zero in the file, i.e. something
like "FCS (Calculated): 0x2CDDCC8F".
I asked Varanofiev some time ago about the "media subtype" values, but he
didn't know the difference between 1 and 3.