Ask Your Question
0

Why am I not seeing different 802.11 frame types in my capture?

asked 2022-04-23 22:13:32 +0000

updated 2022-04-24 18:46:32 +0000

Guy Harris gravatar image

Hello everyone,

I am getting used to Wireshark operation and currently, I am investigating different frames (control, management, data frame) and using filter in these links (https://mrncciew.com/2014/10/02/cwap-... or https://semfionetworks.com/wp-content...) However, I don't know why I cannot find the same information in my pcap file (https://drive.google.com/file/d/1l6iR...). I also tried to search through other files but nothing as I expected was found.

If it is not possible to follow the mentioned links, is there any other ways to find information about existing frames in my capture.

Thank you, Huy Nguyen.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2022-04-23 23:06:51 +0000

Bob Jones gravatar image

The reason you cannot see control/management/data type frames is that they are visible only when using monitor mode 802.11 capture configurations, while your encapsulation type is Ethernet for the sample you provided.

Here is a link to get you started: https://wiki.wireshark.org/Wi-Fi, especially this link from that page: https://wiki.wireshark.org/CaptureSetup/WLAN.

edit flag offensive delete link more

Comments

Hello Bob,

Thank you for your reply. Via your link, I can change from Ethernet to monitor mode 802.11 already in my Wireshark already. However, is there any way for me to see Ethernet as 802.11 like converting my captured file from Ethernet to 802.11? It is not very advisable for me to capture new files. (my use of words may not be very correct but hope you know what I mean) I searched through the Internet but nothing much help

huytyskland gravatar imagehuytyskland ( 2022-04-24 08:03:56 +0000 )edit

There is no way to convert the frames to 802.11. That information is lost, unfortunately.

Bob Jones gravatar imageBob Jones ( 2022-04-24 18:25:03 +0000 )edit

Non-monitor-mode captures will see only data frames; there will be no control or management frames in the capture. That's just the way 802.11 adapters work.

Guy Harris gravatar imageGuy Harris ( 2022-04-24 18:47:30 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2022-04-23 22:13:32 +0000

Seen: 189 times

Last updated: Apr 24