Thursday, 14 November 2019

Wireshark Showing FCS Fields as "Unverified" in Captures

In a recent Wireshark 3.0.6 capture I noticed that FCS values for captured wireless frames were showing as "Unverified". I wasn't sure why this was the case, as I'm sure that Wireshark usually shows a "good" or "bad"  FCS indication. The image below demonstrates what I saw:

After some googling, I found a note that the FCS check was disabled by defaut in Wireshark 3.0.x as some NICs report the FCS check incorrectly. 

The following process details how to re-enable the check: 

  • Go to Edit -> Preferences -> Advanced in Wireshark. Enter "wlan.check" in the search bar:


Double click on the "False" word for the attribute "wlan.check_checksum". This will toggle it to "True" (make sure you click on the "False" word, not anywhere else on the line). 


Hit OK and see the change immediately in your capture decode:


Hope this quick note may help someone in the future (...probably me when I've forgotten how I fixed this!)

References: