tshark filter wlan.fcs.status==1 does not work with v3.0.2,

tshark
fcs
retag add tags

I use tshark to read packets and remove valid ones with the filter option "wlan.fcs.status == 1". However, that option does not work after installing newer Wireshark version v3.0.2. The same field does not even show up on Wireshark UI anymore. Is there a new filed option that I can use with tshark to remove FCS failed packets.

The error I see from Wireshark UI is that under the 802.11 MAC header, the FCS status is marked as "Unverified". Whereas previous versions would report "Good" or "Bad".

Sudheer

asked 2019-06-18 01:04:18 +0000, updated 2019-06-18 01:11:19 +0000

edit flag offensive 0 remove flag close merge delete

Comments

I found that it is tied to the default setting on Wireshark v3.0.2 with Preferences > Advances > wlan.check_checksum is set to FALSE. On previous versions, it is set to TRUE.

Is there any option to enable wlan checksum verification while reading packets using shark ?

Sudheer (2019-06-18 01:27:49 +0000) edit

What do you mean by "shark"? Do you mean Wireshark, TShark, or some other program?

Guy Harris (2019-06-18 03:59:54 +0000) edit

I meant tshark (auto-correct changed it to shark). I was able to figure out the answer by using a tshark option to edit preference settings. tshark -o "wlan.check_checksum:TRUE"

Sudheer (2019-06-19 06:46:14 +0000) edit

add a comment see more comments

Comments

which through the GUI is >> Preference >> Advanced and then double clicking on the value field of wlan.check_checksum (if it is false)

pm89 (2019-10-28 19:32:04 +0000) edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

tshark filter wlan.fcs.status==1 does not work with v3.0.2, edit

Comments

1 Answer

Comments