|From: Lorand JAKAB
[snip]
|Another problem would be, that all packets captured on wireless links
|are tagged at the end with "[Malformed Packet: IEEE 802.11]" because
|ethereal tries to decode the last four bytes as part of the Tagged
|Parameters. I stripped off the prism monitoring header and the
|last four
|bytes, and checked if the remaining bytes' CRC32 matches the last 4
|bytes. The packets I checked matched them. Also, in the IEEE 803.11
|standard the last field of a frame is CRC32. I think this should be
|corrected.
You are right. Although some 802.11 captures don't have this 32-bit FCS.
There is a preference for this in Ethereal; it is off by default. Go to the
Preferences, open the Protocols and choose "IEEE 801.11". Put a check mark
at "Assume packets have FCS", click on Save if you want this setting to be
saved to your preferences, or just OK if you want the setting to be
effective for this Ethereal session only.
Regards,
Olivier