I guess not every device works well in monitor mode; I used 3 different
wireless adapters and 2 of them (belkin and dlink) were missing between 30%
to 60% of the frames, the last one (linksys) misses about 5%. The computer I
am monitoring is 2 feet from the monitoring device, same room, same desk. I
haven't tried using those antenna gain adapters, they may help; none of the
devices I tried were responding to iwconfig sensitivity commands which I
hoped would boost the receiving sensitivity. If the beacon frames are
somehow causing a problem, you could try to increase the beacon period on
the AP, if this is configurable on your AP. If you are only looking at a
particular channel you could set your monitoring device to that channel only
(iwconfig <dev> mode monitor channel <x>) and see if that helps.
It was not wireshark's fault, when I switched from wireless monitoring to
ethernet card monitoring I got 100% of the packets I expected.
Mattr.
--------------------------------------------------
From: "Anders Broman" <a.broman@xxxxxxxxx>
Sent: Tuesday, February 10, 2009 10:55 PM
To: "'Community support list for Wireshark'"
<wireshark-users@xxxxxxxxxxxxx>; <danicamps81@xxxxxxxxx>
Subject: Re: [Wireshark-users] Question on wireshark capture in Wi-Fi
network
In the attached file you can see the capture. As it can be seen in the
trace marked with red arrows the transmitted sequence numbers are not
contiguous which means that some frames are lost. Now, my question is
whether is there any way that I can get wireshark to tell me if these
packets are really lost:
I don't know how the monitoring works but isn't it suspicious that "packet
drop" happens when beacon frames are seen?
Regards
Anders
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
