Subject: Re: 1.5Q: tcpdump vs. wi0?
To: Tero Kivinen <firstname.lastname@example.org>
From: John Hawkinson <jhawk@MIT.EDU>
Date: 01/03/2001 12:29:06
| If you try to ping the another wireless node, it does not work when
| the interface is in the promiscuous mode. The reason is that you see
| the arp replies from the real wireless node directly that are not
| directed to you, thus you start sending the packets directly to the
| wireless node instead of sending them to the base station.
Huh? That's not how it works.
The source and destination MAC addresses are always those of the endstations,
regardless of whether you're talking through an access point or not (802.11
actually has more than two MAC addresses in each frame, but it shouldn't
be necessary to violate that abstraction here). At least, that's what should
There's no such concept as sending packets "directly to the wireless node,"
it's a broadcast medium.
ARP in 802.11 has no concept of access points (unless you're talking to
the management interface of one, in which case it is just like an endstation).
| I have noticed the same problem but it is related to running the wi
| device in promiscuous mode and connecting to machines that are on the
| same wireless network than me. It also depends on about the machine
| you are pinging to, some of those simply reject all packets not coming
| from the base station or something (I think the macintosh did that...).
This doesn't seem to make sense. Of course, there might be bugs...
If you could show traces that demonstrate this behavior, that would be best...