0

I am getting used to Wireshark operation and currently, I am investigating different frames (control, management, data frame) and using filter in these links (https://mrncciew.com/2014/10/02/cwap-802-11-control-frame-types/ or https://semfionetworks.com/wp-content/uploads/2021/04/wireshark_802.11_filters_-_reference_sheet.pdf) However, I don't know why I cannot find the same information in my pcap file (https://drive.google.com/file/d/1l6iRmogpDU-4wR4WY5qzb-vKCtXd8abW/view?usp=sharing). I also tried to search through other files but nothing as I expected was found.

If it is not possible to follow the mentioned links, is there any other ways to find information about existing frames in my capture.

Thank you, Huy Nguyen.

Improve this question
2
  • Has any answer solved your question? Then please accept it or your question will keep popping up here forever. Please also consider voting for useful answers.
    – Zac67 ♦
    Commented Sep 21, 2022 at 11:25
  • 1
    I'm sorry. I already did that
    – Nguyen Huy
    Commented Sep 22, 2022 at 12:44

1 Answer 1

Reset to default
0

Depending on the operating system, the NIC driver and the capture library, capturing wireless traffic usually just shows 'fake' Ethernet frames. Especially on Windows this is the way how 802.11 frames are passed to the OS by the NIC driver.

The NIC and the capture library need to support monitor mode and that mode needs to be activated to show real 802.11 frames.

See https://wiki.wireshark.org/CaptureSetup/WLAN for details.

Improve this answer
2
  • Hello @Zac67, thank you for your reply. I can change the mode in Wireshark to capture 802.11 packets by now. About the data that I captured earlier, is there any way for me to convert them in to 802.11 form so that I can see those types of frame? (maybe my use of words is incorrect but hope you know what I mean)
    – Nguyen Huy
    Commented Apr 24, 2022 at 9:09
  • No, you can't convert them back to 802.11 since the removed information is lost.
    – Zac67 ♦
    Commented Apr 24, 2022 at 10:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.