Capturing wifi management frames never sees frames with wlan.fc=0x0803
Hi Capturing wifi traffc on windows PC using a netgear A6210. Putting this in 'monitor' mode with ofdm modulation allows me to get what looks like all traffic on a specific channel (all set using wlanhelper in npcap).
However, I cannot see any frames with the FC field with the toDS/fromDS fields set to values other than 0 specifically data frames with toDS=1, fromDS=1. (ie filter wlan.fc==0x803)
I _know_ that there are such frames on the air because my embedded device that I am developing is sending them (nrf5340/nrf7002 combo). If the device sets fc=0800 (ie toDS/fromDS=0) then wireshark sees the frames. If it sets fc=0803 then no frames... A cisco AP is able to see these frames, as is wireshark on a MAC (sadly neither of these are in my office...)
What am I doing wrong that I can't see these specific frames?
I would question the A6210.
Are you looking for frames where
wlan.fc.dsis 3?static const value_string tofrom_ds[] = { {0, "Not leaving DS or network is operating in AD-HOC mode (To DS: 0 From DS: 0)"}, {FLAG_TO_DS, "Frame is entering DS (To DS: 1 From DS: 0)"}, {FLAG_FROM_DS, "Frame is exiting DS (To DS: 0 From DS: 1)"}, {FLAG_TO_DS|FLAG_FROM_DS, "Frame part of WDS (To DS: 1 From DS: 1)"}, {0, NULL} };Yes, DS equal to 3 (mistakenly typed DA sorry) : edited question to fix this.
Ok - just wanted to verify it wasn't a display filter issue.
To expand on @Jaap comment, search in the npcap issues for
netgearora6210. Your exact scenario doesn't pop up but they do entertain questions about the driver there.Another option is to bolt (velcro) a Raspberry Pi to your system and do capture with it, feeding the output back to Wireshark on the PC. Kali seems to bundle support for monitor mode now (https://www.kali.org/blog/raspberry-p...) or you do it adding nexmon to a Raspberry Pi OS (previously called Raspbian) image. Raspberry Pi's USB gadget mode enabled a USB connection to emulate a network interface. This would allow Wireshark on the PC to capture with
sshdumpon the Pi or feed the output back over ssh and read in via interface stdin (-i -).Captures attached to 7115: 802.11s Decoding Bug (Mesh Control Field) have packets that match
radiotap.channel.flags.ofdm == True and wlan.fc.ds == 3