[Guy Harris <gharris@xxxxxxxxx>]

PoWah Wong wrote:
> Attached is the binary capture with *1* frame.

The problem is that the packets have an FCS at the end; there's no way, 
currently, for the driver to indicate that the packets have an FCS 
(other than switching from the Prism radio header to the radiotap radio 
header, and indicating it in the radio header), so there's no way for 
Ethereal to know that the packets have an FCS at the end without the 
user telling it that they do.

The way to do that is to turn on the "Assume packets have FCS" 
preference for the "IEEE 802.11" protocol.  If that option is off, the 
802.11 dissector assumes that the last 4 bytes of the packet are packet 
data, and those 4 bytes look like an incomplete tagged parameter, and 
that incomplete tagged parameter, because it *is* incomplete, causes the 
frame to be marked as malformed.  If that option is on, the last 4 bytes 
in that capture are reported as a correct CRC.