eapol is malformed unless I assume don't have FCS but then all other packets are malformed
If I have default settings (except for the decryptions set in IEEE 802.11), my eapol packets show as Malformed Packet but the other packets (albeit they only show protocol 802.11) all seem to be ok.
I found I can set "Assume all packets DON'T have an FCS at the end" then my eapol packets show up properly but now the other packets are malformed.
Is there any way to have the FCS bit override setting ONLY for the eapol or am I doing something else wrong?
I assume you are using a monitor mode adapter? And that you are not using the same adapter to connect to the AP and also capture in some mode?
Some monitor mode drivers pass up the FCS, some do not. Before changing the setting, what does yours do? Check the IEEE 802.11 field in the packet details pane and see if there is Frame Check Sequence field.
The Radiotap header, if you have one, under the flags field has an FCS-at-end field. Do you have this / what is it set to?
I believe I'm using monitor mode. I was able to tick the box and I'm seeing plenty of traffic that's not my own (including other wifi networks). I'm connected via ethernet cable to the net and using a wifi usb to monitor so it shouldn't be interfering. My system has suddenly decided to not pick up eapol's at all now and just showing a bunch of beacon frames and I don't know what I did but currently for the IEEE 802.11 Frame Check Sequence field it's showing 0x0800f800 [unverified]. As for the the radiotap header I do have one and FCS-at-end is True. I wish I could check this against my eapol headers, I'm trying to retrace my steps to get them back (and I am trying to reconnect my phone to trigger it).
Managed to get my eapols working again. Not sure if this fixed it but I noticed all my traffic was ipv6 so I disabled ipv6 on my adapter and eapols started showing again. But still, malformed (unless I use "assume all packets don't have an FCS at the end").
My EAPOL has a FCS at end: True flag in Radiotap header, and also Bad FCS: True. The Frame Check Sequence for my EAPOLs are 0x0000f9b4 [unverified]
For my regular packets, FCS at end = true, Bad FCS = true and Frame Check Sequence = 0x0800f800
I really have no idea what all this really means but I hope it helps narrow the problem.
On what operating system are you capturing this?
Windows 10