Functioning of FCS checkbox in IEE802.11 prot

["Emburey Samrex Edward -X (emedward - EMBED UR SYSTEMS at Cisco)" <emedward () cisco com>]

Hi Team,

Thanks for your attention!

This is regd the FCS representation in the 802.11 frames.

Most of the Cisco APs do have the last 4-byte of FCS, which is rightly represented in the wireshark captures.

Whereas, in a recent AP, we do not include this 4byte FCS.
So we go for the option in 'Edit-->Preferences-->Protocol-->IEEE 802.11-->Assume packets have FCS'
But still, wireshark treats the last 4-bytes as FCS; as a result it is shown as malformed packets.

Could you please let us know about this setting.
Like, would we need to make any other extra config, for the wireshark tool to not mark the pkts as malformed?
OR there is a valid bug here in this setting.
For reference I had attached the working & non-working cases of the pkt captures.


Thanks and Regards,
Emburey

Attachment: non_working_case.pcap
Description: non_working_case.pcap

Attachment: working_case.pcap
Description: working_case.pcap

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe