On Sun, Dec 21, 2003 at 06:28:25PM -0800, Guy Harris wrote:
> On Sun, Dec 21, 2003 at 02:53:28PM -0800, Aleksandr Milewski wrote:
> > I just built a machine to run as a wireless sniffer, and things are
> > mostly working, but all 802.11 management frames come through as
> > malformed, apparently because the FCS isn't dissected properly.
> >
> > In particular, the end of every packet is a random tag number with a
> > random length...it looks like the FCS is getting dissected as a TLV.
>
> I'd need to see a capture in order to see why it's happening.
It's happening because you haven't set the "Assume packets have FCS"
preference for the 802.11 dissector, and because we don't have a way of
automatically determining whether packets in an 802.11 libpcap capture
have an FCS or not.
Select "Preferences" from the "Edit" menu, open up the "Protocols" list,
select "IEEE 802.11", turn on the "Assume packets have FCS" option,
click "Save" if you want that setting to persist after you exit
Ethereal, and click "OK".