Reassemble Wireshark WiFi captured LLC packets into original message

Wireshark automatically reassembles fragmented 802.11 data frames at the MAC layer before passing them to higher protocols, meaning you rarely need to manually reconstruct LLC packets. If fragments appear disjointed, it is usually due to missing capture time or incorrect filter usage rather than a failure in reassembly logic.

Understanding Wireshark’s Automatic Reassembly

When capturing wireless traffic, the 802.11 standard often splits large payloads into multiple subframes because of the maximum transmission unit (MTU) limits inherent in radio frequency communications. Unlike TCP, which has explicit sequence numbers and acknowledgments for stream reassembly, 802.11 handles fragmentation at the Media Access Control (MAC) layer. Wireshark’s display engine is designed to detect these fragments based on the More Fragments flag in the Frame Control field and the Fragment Number. Once Wireshark identifies that a series of frames belong to the same original packet, it concatenates the payload bytes internally. This process happens transparently. When you view the packet details tree, the "Data" section under the 802.11 header shows the complete, reassembled payload, not the individual fragment pieces. Therefore, the premise of manually stitching together raw byte strings from separate LLC packets is technically flawed and unnecessary for standard analysis. If you are looking at individual frames and seeing incomplete data, it is likely because you are viewing the raw 802.11 frame structure rather than the reassembled protocol stream. The LLC (Logical Link Control) header sits above the 802.11 MAC header but below the network layer protocols like IP or ARP. Wireshark parses this hierarchy correctly, provided the underlying 802.11 fragmentation is resolved first.

Why Manual Concatenation Fails

Attempting to manually extract and concatenate hex dumps from multiple frames is dangerous for several reasons. First, you may miss control frames or management frames that intersperse the data traffic. Second, encryption layers such as WPA2-Personal or WPA3 encrypt the 802.11 payload. If you do not have the pre-shared key (PSK) loaded into Wireshark, the payload appears as gibberish. Manually combining encrypted fragments will result in corrupted data that cannot be decrypted by Wireshark’s automatic decryption engines, leading to false conclusions about packet content. For more on encryption challenges, see WPA PTK and GTK in Detail: Understanding Wireless Network Encryption.

Diagnosing Missing or Disjointed Frames

If your capture shows fragmented packets that Wireshark fails to reassemble, the issue is almost always related to capture configuration or network conditions, not Wireshark’s parsing logic. Follow these steps to ensure proper reassembly occurs.

1. Check Capture Duration: Fragmentation requires multiple frames transmitted over time. If your capture started after the first fragment was sent, or ended before the last fragment arrived, Wireshark cannot complete the reassembly. Ensure your capture covers the entire transmission window of the target device.
2. Verify Interface Mode: On Linux, ensure your wireless interface is in monitor mode using tools like airmon-ng. In promiscuous mode, some drivers drop management frames or fail to capture all fragments accurately. Monitor mode provides the most complete view of the air interface.
3. Analyze Filter Usage: Applying display filters too early can hide fragments. If you filter for a specific IP address, Wireshark might hide the initial 802.11 headers if they don’t match the filter criteria immediately. Instead, use capture filters during recording or apply display filters only after ensuring all frames are present.

Using Display Filters for Analysis

To verify that reassembly is working, you should look for specific indicators in the Wireshark packet list. A successfully reassembled packet will typically show a single entry in the main list with a larger byte count than the individual fragments would suggest. You can use display filters to isolate fragmented traffic. Use the filter frame.fragment == 1 to find packets where the More Fragments flag is set. Conversely, use frame.fragment == 0 to find the final fragment. If you select a packet that was part of a fragment group, look at the "Frame Details" pane. Expand the IEEE 802.11 Radio Tap or IEEE 802.11 header. Here you will see the Fragment Number and More Fragments fields. If Wireshark has successfully reassembled the packet, the payload displayed under the upper-layer protocol (such as IPv4 or UDP) will be continuous. You should not see gaps in the byte offsets. If you suspect a problem, right-click the packet and select Follow > TCP Stream (if applicable) or simply inspect the Data field. The data should be contiguous without manual intervention. For users analyzing specific application payloads, such as VNC sessions, the principles remain the same. Wireshark handles the transport layer reassembly, allowing you to focus on the application data. See Analyzing VNC Client Interpreted Server C++ Payload in Wireshark: A Tech Support Guide for examples of deep packet inspection once reassembly is confirmed.

Common Pitfalls in WiFi Captures

Another common reason for apparent data loss is the presence of beacon frames or probe responses that share similar BSSID values but carry different information elements. These are management frames, not data frames, and they do not contribute to LLC payload reassembly. Do not confuse high traffic volumes of management frames with fragmented data streams. Additionally, ensure that your capture file is not truncated. If you stop capturing mid-transmission, the final fragment is lost. Wireshark will mark these as "malformed" or leave the previous fragment unreassembled. Always check the end of your capture file to ensure the last few seconds contain complete transmissions. If you encounter issues with file corruption unrelated to networking, such as broken media files captured in mixed environments, refer to JPEG Corrupted File Fixing, though this is distinct from network packet reassembly.

Frequently Asked Questions

Why does my Wireshark capture show "Malformed Packet" errors?

This usually indicates that a frame was truncated during capture or that the driver failed to deliver the complete buffer to Wireshark. Check your capture duration and ensure the interface remains in monitor mode throughout the session. Retrying the capture with a shorter burst size may also help.

Can I decrypt 802.11 fragments without the PSK?

No. The 802.11 payload is encrypted using keys derived from the PSK. Without the correct password loaded in Wireshark’s preferences, the reassembled payload will remain ciphertext. You must configure the Encryption Keys in Edit > Preferences > Protocols > IEEE 802.11 to view plaintext data.

How do I identify the start and end of a fragmented packet?

Look for the More Fragments bit in the Frame Control field. A value of 1 means more fragments follow, while 0 indicates the last fragment. The Fragment Number field increments for each subsequent piece of the same original packet.

What is the difference between LLC and 802.11 headers?

The 802.11 header contains MAC addresses and control flags for wireless transmission, including fragmentation info. The LLC header sits above it and defines the type of payload (e.g., IPv4, ARP). Wireshark reassembles the 802.11 layer first, then parses the LLC to determine the next protocol layer.

Why are some packets missing from my capture entirely?

This is often due to hardware limitations or driver issues where the NIC drops frames under high load. It can also happen if the capture buffer is full and old packets are overwritten. Use a smaller capture filter to reduce traffic volume and ensure all relevant frames are stored.