Installation guide

Wireless Guide 155
Advanced Features for Wireless Analysis
Possible Cause
In most cases, this is a relatively minor alarm, probably indicating nothing more
than that you neglected to add the address of a known mobile unit to the
Expert's list. However, you may want to examine the address of the mobile unit
indicated in the alarm to make sure that it is not an intruder.
Runt WLAN Frame
The Expert generates the Runt WLAN Frame alarm when it detects an 802.11
MAC frame shorter than the minimum acceptable length dictated by the
802.11 specification.
The minimum acceptable length for an 802.11 MAC frame is 34 bytes.
However, some control and management frames are inherently smaller than
34 bytes. The Expert does not generate alarms for these frames.
Same Transmitter and Receiver Address
The Expert generates the Same Transmitter and Receiver Address alarm
when it detects an 802.11 MAC frame in which the transmitter and receiver
addresses indicated in the frame are the same.
Wireless LAN frames include up to four addresses in the standard 802.11 MAC
format depending on the type of frame. In addition to the Source and
Destination addresses (which refer to the original source of and the final
destination for the protocol data in the frame body field), 802.11 MAC frames
include Transmitter and Receiver addresses. These addresses are those of
the wireless stations responsible for transmitting the frame onto the wireless
medium (transmitter address) and the next recipient of the frame on the
wireless medium (receiver address).
The Expert generates this alarm if the transmitter and receiver addresses
within the frame are the same. If, however, the source and destination
addresses within the same frame are also the same, the Expert will also
generate the Same Source and Destination Address alarm at the Expert
DLC layer.
Transmitter Address Is Broadcast
The Expert generates the Transmitter Address Is Broadcast alarm when it
detects an 802.11 MAC frame with a broadcast address (all 1s) indicated in the
Transmitter Address field.
Transmitter Address Is Multicast
The Expert generates the Transmitter Address Is Multicast alarm when it
detects an 802.11 MAC frame with a multicast address indicated in the
Transmitter Address field.