Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
802.11 malformed packets in monitor mode #1028
I'm capturing 802.11 packets in monitor mode and all of them are malformed. I attached an example of one of the capture here. If you filter by eap or eapol, that should be a sucessful handshaking, but I can't see it because it's all malformed.
I tried two WiFi adapters:
And I used:
I repeated the same process in a Windows Server 2008 with an AirPcap dongle and it works perfectly.
I'm not sure what component is failing:
I run the capture from 2 different PCs, both using Windows 10, and same issue happens.
My problem also is that AirPcap is not available for Windows 10.
It looks like the "IEEE QoS Data" layer expects the last 4 bytes to be some a Frame Check Sequence, but as you can see in packet 1408, that is actually a continuation of the EAP data (e.g. the
I am now doubting that this is related to #1001. That had a malformed radiotap header, and the headers seem to be formed correctly in your example dump.
referenced this issue
Oct 15, 2017
@dmiller-nmap thanks for your instructions. I followed them, but I have the same issue (malformed 802.11 packets). I think I would need the a driver-debug version. I didn't get a blue creen on Windows and the dmp files in my MiniDump folder were modified on 28th September for the last time.
Any other suggestions, please?
pushed a commit
Oct 23, 2017
This issue is still actual, I've just tested in my environment:
There are always 4 excess bytes appended to the 802.11 packet data. If you remove these 4 bytes from the packet end, it would not be marked as "malformed" anymore.
Attached capture sample: broadcom.cap
I've also tested with RTL8187L-based USB Wi-Fi adapter, and it have the same issue while capturing 802.11 packets.
I've got Windows 10 Pro, 64 bits PC and I can install the Airpcap software but the dongle is not detected as an interface in Wireshark. Did you install anything else?…
On Wed, 25 Jul 2018, 09:37 Gisle Vanem, ***@***.***> wrote: @natiya <https://github.com/natiya> You wrote *My problem also is that AirPcap is not available for Windows 10*. What do you mean? I use Win-10 (x64, Intel I7 CPU) and AirPcap. Works just fine. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1028 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/Ad9yWOwb2AXHHVQdSvHcZaZTFB52qiXKks5uKCAmgaJpZM4PwNOp> .
But since my AirPcap adapter cannot transmit (and supports 2 GHz only), I'm not sure a "WiFi Replay Attack" could work.