Subject: 802.11 wireless and tcpdump
To: None <firstname.lastname@example.org>
From: John Maier <email@example.com>
Date: 03/09/2005 19:08:05
I was on a customer site, and they wanted to know how to see if there were
rouge wireless networks in the office, i.e. SSID turned off, etc.
I put in the wireless card, fired up Ethereal (0.10.9) and started
monitoring ath0. I some traffic, but it all looked like regular Ethernet
I read the FAQ at ethereal's website and the mentioned monitor mode, so I
>ifconfig ath0 media autoselect mediaopt monitor up
and when I did a ifconfig fxp0 I could see the channel changing.
Still nothing. I read more carefully and noticed that you have to have
libpcap-0.8.3 installed. Using the pkgsrc, I compiled the latest and
installed. I noticed that libpcap.a was installed, but no shared built or
Since Ethereal builds using the shared pcap lib, I knew I wasn't going to
I installed tcpdump-3.8.3 and tried:
>/usr/pkg/sbin/tcpdump -y ieee802_11_radio -i ath0
tcpdump: data link type ieee802_11_radio
tcpdump: WARNING: ath0: no IPv4 address assigned
tcpdump: libpcap: unknown data link type 0x7f
Now I know I'm not getting anywhere and need help.
So what do I do to get NetBSD 2.0 to capture raw 802.11 packets?
Thanks in advanced.