Subject: Re: 1.5Q: tcpdump vs. wi0?
To: John Hawkinson <>
From: Rafal Boni <>
List: current-users
Date: 01/03/2001 13:09:15
In message <>, jhawk writes: 

-> The source and destination MAC addresses are always those of the 
-> endstations, regardless of whether you're talking through an access
-> point or not (802.11 actually has more than two MAC addresses in each
-> frame, but it shouldn't be necessary to violate that abstraction here). 
-> At least, that's what should be happening.
-> There's no such concept as sending packets "directly to the wireless node,"
-> it's a broadcast medium.
-> ARP in 802.11 has no concept of access points (unless you're talking to
-> the management interface of one, in which case it is just like an endstation
-> ).

-> This doesn't seem to make sense. Of course, there might be bugs...
-> If you could show traces that demonstrate this behavior, that would be 
-> best...

At work, where we've got a switched network, the minute I turn on promisc.
mode on the Lucent, packets stop appearing at the other end (which for this
test was a Linux box wired to 100BaseTX).  Being a switched network, it's 
hard for me to determine if they make it out of the AP at all.

As soon as I kill tcpdump (and hence take the card out of promiscuous 
mode), packets start appearing at the remote end.  tcpdump'ing in non-
promisc. mode doesn't affect the traffic, so I'm guessing it must be a
bug in promisc. mode in the firmware or wi driver itself.

I'll give this a try at home if I can figure out where I put my old crusty
10Mbps hub so I can be sure I catch everything coming out of the AP


Rafal Boni