Subject: Re: 1.5Q: tcpdump vs. wi0?
To: John Hawkinson <jhawk@mit.edu>
From: Rafal Boni <rafal@mediaone.net>
List: current-users
Date: 01/03/2001 13:09:15
In message <200101031729.MAA10751@multics.mit.edu>, jhawk writes:
-> The source and destination MAC addresses are always those of the
-> endstations, regardless of whether you're talking through an access
-> point or not (802.11 actually has more than two MAC addresses in each
-> frame, but it shouldn't be necessary to violate that abstraction here).
-> At least, that's what should be happening.
->
-> There's no such concept as sending packets "directly to the wireless node,"
-> it's a broadcast medium.
->
-> ARP in 802.11 has no concept of access points (unless you're talking to
-> the management interface of one, in which case it is just like an endstation
-> ).
-> This doesn't seem to make sense. Of course, there might be bugs...
->
-> If you could show traces that demonstrate this behavior, that would be
-> best...
At work, where we've got a switched network, the minute I turn on promisc.
mode on the Lucent, packets stop appearing at the other end (which for this
test was a Linux box wired to 100BaseTX). Being a switched network, it's
hard for me to determine if they make it out of the AP at all.
As soon as I kill tcpdump (and hence take the card out of promiscuous
mode), packets start appearing at the remote end. tcpdump'ing in non-
promisc. mode doesn't affect the traffic, so I'm guessing it must be a
bug in promisc. mode in the firmware or wi driver itself.
I'll give this a try at home if I can figure out where I put my old crusty
10Mbps hub so I can be sure I catch everything coming out of the AP
--rafal
----
Rafal Boni rafal@mediaone.net