Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Question on wireshark capture in Wi-Fi network

From: Steve Evans <sc_evans@xxxxxxxxx>
Date: Tue, 10 Feb 2009 13:32:29 -0800 (PST)
Hi,

Generally I hardly ever look at the conversations screen and focus on the packet window. If you would be willing to switch, here are some tips:

> -Is there a way to ask wireshark to report FCS errors on
> the measured interface ?

I use the filter wlan.fcs_bad == 1 and filter on all packets to/from your adapter.

> -Could I get a reading of the power that was received in
> the interface during the moments when a packet should have
> been lost ?


You can insert a column in the packet window to display radiotap.db_antsignal. That will give you a close approximation of the received signal (RSSI) by the adapter.

> -What other things could be happening? Maybe is a failure
> of wireshark and the packet is actually there ? Can this be
> checked ?

Packets get missed by WS sometimes. You can perhaps try capturing on a faster CPU box or update your capture drivers to see if it makes a difference.

/Steve

--- On Tue, 2/10/09, Dani Camps <danicamps81@xxxxxxxxx> wrote:

> From: Dani Camps <danicamps81@xxxxxxxxx>
> Subject: [Wireshark-users] Question on wireshark capture in Wi-Fi network
> To: wireshark-users@xxxxxxxxxxxxx
> Date: Tuesday, February 10, 2009, 4:09 PM
> Dear all,
> 
> I am trying to do captures of a traffic RTP/UDP Video flow
> streamed over a Wi-Fi network using wireshark. Basically I
> set my wireless card into monitor mode and then I can see
> all the traffic over the Wi-Fi interface (802.11 signaling)
> by running wireshark on the interface.
> 
> In the attached file you can see the capture. As it can be
> seen in the trace marked with red arrows the transmitted
> sequence numbers are not contiguous which means that some
> frames are lost. Now, my question is whether is there any
> way that I can get wireshark to tell me if these packets are
> really lost:
> 
> -Is there a way to ask wireshark to report FCS errors on
> the measured interface ?
> 
> -Could I get a reading of the power that was received in
> the interface during the moments when a packet should have
> been lost ?
> 
> -What other things could be happening? Maybe is a failure
> of wireshark and the packet is actually there ? Can this be
> checked ?
> 
> Thanks!
> 
> Daniel
> 
> 
> 
>      
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list
> <wireshark-users@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe:
> https://wireshark.org/mailman/options/wireshark-users
>             
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe