Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

For the sample trace, apply this filter:

wlan.addr == c8:3d:d4:a0:94:45

Look right before the referenced multicast frame at 929; see all of the CTS and Block ACK frames? Each of these pairs is very likely a successful unicast frame transfer between client and AP that your capture system did not pick up. Signal strength is OK, so I bet client/AP are using 802.11n modulations but your adapter is only picking up 802.11bg. Until retries drop modulation/datarate to levels that your capture system can pick up, you will continue to miss the bulk of your data traffic.

image description

The beacon for this network indicates that it is HT capable with LDPC support, SGI, 2SS. You can either try a different capture adapter or reduce the datarates on the AP by disabling 802.11n support as a test. Then you should see the bulk of the traffic, as you expect.