Ask Your Question
0

tshark filter wlan.fcs.status==1 does not work with v3.0.2,

asked 2019-06-18 01:04:18 +0000

Sudheer gravatar image

updated 2019-06-18 01:11:19 +0000

I use tshark to read packets and remove valid ones with the filter option "wlan.fcs.status == 1". However, that option does not work after installing newer Wireshark version v3.0.2. The same field does not even show up on Wireshark UI anymore. Is there a new filed option that I can use with tshark to remove FCS failed packets.

The error I see from Wireshark UI is that under the 802.11 MAC header, the FCS status is marked as "Unverified". Whereas previous versions would report "Good" or "Bad".

edit retag flag offensive close merge delete

Comments

I found that it is tied to the default setting on Wireshark v3.0.2 with Preferences > Advances > wlan.check_checksum is set to FALSE. On previous versions, it is set to TRUE.

Is there any option to enable wlan checksum verification while reading packets using shark ?

Sudheer gravatar imageSudheer ( 2019-06-18 01:27:49 +0000 )edit

What do you mean by "shark"? Do you mean Wireshark, TShark, or some other program?

Guy Harris gravatar imageGuy Harris ( 2019-06-18 03:59:54 +0000 )edit

I meant tshark (auto-correct changed it to shark). I was able to figure out the answer by using a tshark option to edit preference settings. tshark -o "wlan.check_checksum:TRUE"

Sudheer gravatar imageSudheer ( 2019-06-19 06:46:14 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2019-06-19 06:46:55 +0000

Sudheer gravatar image

I was able to figure out the answer by using a tshark option to edit preference settings. tshark -o "wlan.check_checksum:TRUE"

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2019-06-18 01:04:18 +0000

Seen: 72 times

Last updated: Jun 19