Guy Harris wrote: > (In Martijn's original capture - the 11g-bug-gw-smc.apc one - there > were packets with CRC errors according to Ethereal - it turns out that > a media subtype value of 1 appears to mean "802.11 with 4 bytes of 0 at > the end" and 3 appears to mean "802.11 with 4 bytes of FCS at the end" > - that didn't have the "CRC Error" flag set. They appeared to be > largely duplicates of other packets; in at least two of the cases, at > least one of the other packets had a valid CRC, and the duplicates with > the bad CRC appeared to have bad data in them, e.g. the SSID appeared > to be corrupt. Could these be duplicates caused by multipath problems, > so that multiple copies of the packet arrived by different paths? In > those two cases, the bad copies showed up after the good copies; > perhaps the NIC keeps track of received packets, e.g. remembering > sequence numbers and perhaps addresses and, if it sees a duplicate > packet, supplies it to the host, at least in monitor mode, but doesn't > bother to checksum it - and doesn't supply any "probably multipath" > indicator?)
I have no idea about why some packets seems to be corrupt. My experience with 802.11 is very limited so far. Maybe Martijn knowns more about under what circumstances the capture was done. Regarding the difference between "media subtype 1" and "media subtype 3" you may be correct that the difference is if FCS is included or not. It seems that the captures I have with media type 1 are with FCS octets set to 00 00 00 00 and Airopeek shows a calculated value for FCS for those files. However if I change the value for "media subtype" in a file I don't see any difference. Independently of the value for media subtype Airopeek seems to display the FCS value if it is non-zero (e.g. "FCS: 0x55A7E35C", or "FCS: 0x77DD110011 FCS Invalid, should be 0x342543423" ) and shows a calculated value if the FCS is zero in the file, i.e. something like "FCS (Calculated): 0x2CDDCC8F". I asked Varanofiev some time ago about the "media subtype" values, but he didn't know the difference between 1 and 3. _______________________________________________ Ethereal-dev mailing list [EMAIL PROTECTED] http://www.ethereal.com/mailman/listinfo/ethereal-dev
