Installation guide

Chapter 10
156 Sniffer Technologies
WEP-ICV Error
The Expert generates the WEP-ICV Error alarm when it detects a
WEP-encrypted packet with an Integrity Check Value (ICV) which does not
match the ICV calculated by the Expert using its own WEP keys. This usually
happens when the Sniffer software is configured with an incorrect set of WEP
keys.
In a wireless network using shared key authentication, each station on the
network is programmed with the same four WEP keys (1-4). Wireless stations
send WEP-encrypted packets with header fields indicating which of the four
shared WEP keys was used to encrypt the data. Receiving stations use the
shared key indicated in the packet’s header (1-4) for decryption and calculate
an expected Integrity Check Value (like a checksum for the encrypted data) to
compare against the ICV included in the received packet.
When the Sniffer software detects a WEP-encrypted packet, it attempts to
decrypt the data using its own shared WEP keys specified on the 802.11 tab
of the Options dialog box (accessed from the Tools > Options menu). If the
ICV it calculates using its WEP keys does not match the ICV included in the
packet, the Expert generates this alarm.
Possible Causes
1 The Expert is configured with WEP keys which do not match those in
use on the wireless network being analyzed. Go to the 802.11 tab of the
Options dialog box (accessed from the Tools > Options menu), and
make sure that the WEP keys specified there match those in use on the
network.
2 The station that sent the offending packet is configured with the wrong
WEP keys for the network. Make sure its keys are programmed
correctly.