Some Netmon "IEEE 802.11 plus Network Monitor radio header" captures dissected incorrectly

This issue was migrated from bug 11105 in our old bug tracker.

Original bug information:

Reporter: Bill Meier
Status: RESOLVED FIXED
Product: Wireshark
Component: Dissection engine (libwireshark)
OS: Windows Server 2003
Platform: All
Version: Git

Bill Meier said:

Build Information:

The issue: Management/Control frames as saved by Netmon (3.4 ?) with encapsulation "IEEE 802.11 plus Network Monitor radio header" may or may not be saved with an FCS.

The current code assumes that there's always an FCS for these frames.

See:

Bug #4781:  Capture file with Management/Control frames with no FCS;

Bug #5281:  Capture file with Management frames with an FCS

My Fix (in progress):  Change the code in packet-ieee80211.c related to handling "IEEE 802.11 plus Network Monitor radio header" encapsulation to observe the "wlan_check_fcs" preference for IEEE80211 Management & Control frames


An aside: Some testing of the Microsoft Netmon 3.4 "wireless.npl" parser shows that it determines the presence/absence of an FCS by noticing if there are 4 bytes left over after parsing the wireless frame. (There is some code testing the flag "FCSPresent" but that flag is always set to FALSE).

added libwireshark oswindows versiondev labels

Bill Meier said:

See https://code.wireshark.org/review/#/c/7939/

Bill Meier said:

Fix committed in gd3f2d8ce.

closed