why FCS always the same

Question

Hi,

I'm learning 802.11 and I'm using microsoft network monitor 3.4 to capture some packets, it's in netmon mode, I found the FCS(Frame Check Sequence) seems not correct.

a lot of packets are all have the same FCS:0x3100400, even if they have different content and length. According to the book, it should be the CRC value of the whole MAC fields and data body,  why?

another question about the Metadata,  nm3.4 always displays the 32-bytes MetaData. so the frame length displayed is wrong, for example, in the above picture the frame is 46 bytes, but it's actually 14 bytes, why it's necessary to count in the 32 bytes of MetaData? Anyway to remove that?

Thanks.

//Brs

Answer 1

We capture the data at a place in the stack where the FCS value has not be calucalated yet, and we can't capture the real value.  This is populated by the hardware and at the NDIS level where we capture the raw data, it is often not passed on to NDIS.

For the metadata size, our driver adds this on to the frame and changes the actual length we record.  While this isn't sent on the wire, it is captured by our driver.  I agree this isn't an accurate picture of the wireless frame that is sent but there is no way to remove it at this time.

Paul

Answer 2

Thanks for the reply.