Wireshark-bugs: [Wireshark-bugs] [Bug 4781] New: IEEE 802.11 frames in Microsoft Network Monitor
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sun, 23 May 2010 09:58:11 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4781

           Summary: IEEE 802.11 frames in Microsoft Network Monitor
                    3.3.1641.0 capture files not dissected correctly
           Product: Wireshark
           Version: SVN
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Minor
          Priority: Low
         Component: Wireshark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: tyson.key@xxxxxxxxx


Created an attachment (id=4674)
 --> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=4674)
A MS NetMon 3.3 capture file containing IEEE 802.11 frames

Build Information:
Version 1.3.6-SVN-32907 (SVN Rev 32907 from /trunk)

Copyright 1998-2010 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GTK+ 2.16.6, (32-bit) with GLib 2.22.4, with WinPcap (version
unknown), with libz 1.2.3, without POSIX capabilities, without libpcre, with
SMI
0.4.8, with c-ares 1.7.1, with Lua 5.1, without Python, with GnuTLS 2.8.5, with
Gcrypt 1.4.5, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built
May
20 2010), with AirPcap, with new_packet_list.

Running on Windows XP Service Pack 3, build 2600, with WinPcap version 4.1.1
(packet.dll version 4.1.0.1753), based on libpcap version 1.0 branch 1_0_rel0b
(20091008), GnuTLS 2.8.5, Gcrypt 1.4.5, without AirPcap.

Built using Microsoft Visual C++ 9.0 build 30729

Wireshark is Open Source Software released under the GNU General Public
License.

Check the man page and http://www.wireshark.org for more information.
--
It appears that using most recent versions of Wireshark, including the SVN
version listed, all frames captured from IEEE 802.11 interfaces by Microsoft
Network Monitor 3.3 are incorrectly dissected as Ethernet frames containing
Fibre Channel traffic encapsulated with an MDS header.

Even if no Ethernet (or other link-layer type) interfaces were selected at the
time of capture, this is seemingly always the case.

A sample capture file is attached for reference.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.