Subject: Re: PRISM2 monitor mode patch
To: None <firstname.lastname@example.org>
From: Kevin Lahey <email@example.com>
Date: 11/08/2002 16:47:33
On Fri, 8 Nov 2002 16:14:03 -0600
David Young <firstname.lastname@example.org> wrote:
> Are RTS/CTS frames exposed? It will help me to prove a bug in the Prism
> firmware to monitor those. Fragments?
My impression, from reading source code and various web sites, is that
it gets *everything*. I wouldn't swear to it, though.
> In monitor mode, is a frame header is no larger than a wi_frame? I had
> thought that explained why the "generic" libpcap expects an enormous
> header for DLT_PRISM_HEADER.
It looks like it gets the regular frame header, just like the other
modes on the card.
> BTW, I have patched tcpdump/libpcap/wi(4) so that you can monitor RSSI
> and other aspects of the Prism header using tcpdump. You can see the
> patches at http://che.ojctech.com/~dyoung/patches/. If these patches
> look generally useful, I will commit them.
Cool, perhaps I'll try to combine them!
On a related question, I really like the recent changes to libpcap to
support the retrieval of different frame types from a given interface.
Has anybody made the hacks to ethereal to support this? It sure would
be cool to have a pull-down list of the frame types supported by a given