Wireshark-users: Re: [Wireshark-users] 802.11 malformed packets

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 2 Mar 2009 15:10:30 -0800

On Mar 2, 2009, at 12:43 PM, Craig R wrote:

I'm seeing a tremendous amount of malformed packets specifically associated with probe response, and beacon frames with 802.11 (wireless card in macbook pro), in wlan mode or wlan +avs wlan header, promiscuous. The monitor mode is working (seeing eap on another laptop)-- good, just these malformed packets. Got this with . 6 stable and new 1.1.2 development version.

There might be a dissector bug, or, in monitor mode, the adapter might be supplying to the host bad packets (e.g., packets it didn't receive entirely correctly, so that some bits got mangled).

We should be able to fix the former; there's nothing we can do about the latter (we don't "own" the low-level capture path), and it's not clear whether that's a "bug" or not.

Could you supply a capture with some of the malformed packets, so we can determine whether it's a dissector bug or not?