[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	11105
Summary	Some Netmon "IEEE 802.11 plus Network Monitor radio header" captures dissected incorrectly
Product	Wireshark
Version	Git
Hardware	All
OS	Windows Server 2003
Status	UNCONFIRMED
Severity	Minor
Priority	Low
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	wmeier@newsguy.com

Build Information:

--
The issue: Management/Control frames as saved by Netmon (3.4 ?) with
encapsulation "IEEE 802.11 plus Network Monitor radio header" may or may not be
saved with an FCS.

The current code assumes that there's always an FCS for these frames.

See:

Bug #4781:  Capture file with Management/Control frames with no FCS;

Bug #5281:  Capture file with Management frames with an FCS

My Fix (in progress):  Change the code in packet-ieee80211.c related to
handling "IEEE 802.11 plus Network Monitor radio header" encapsulation to
observe the "wlan_check_fcs" preference for IEEE80211 Management & Control
frames


An aside: Some testing of the Microsoft Netmon 3.4 "wireless.npl" parser shows
that it determines the presence/absence of an FCS by noticing if there are 4
bytes left over after parsing the wireless frame. (There is some code testing
the flag "FCSPresent" but that flag is always set to FALSE).

---

      You are receiving this mail because:

• You are watching all bug changes.