Subject: Re: PRISM2 monitor mode patch
To: None <>
From: Kevin Lahey <>
List: tech-net
Date: 11/08/2002 16:47:33
On Fri, 8 Nov 2002 16:14:03 -0600
David Young <> wrote:
> Are RTS/CTS frames exposed? It will help me to prove a bug in the Prism
> firmware to monitor those. Fragments?

My impression, from reading source code and various web sites, is that
it gets *everything*.  I wouldn't swear to it, though.
> In monitor mode, is a frame header is no larger than a wi_frame? I had
> thought that explained why the "generic" libpcap expects an enormous
> header for DLT_PRISM_HEADER.

It looks like it gets the regular frame header, just like the other
modes on the card.

> BTW, I have patched tcpdump/libpcap/wi(4) so that you can monitor RSSI
> and other aspects of the Prism header using tcpdump. You can see the
> patches at If these patches
> look generally useful, I will commit them.

Cool, perhaps I'll try to combine them!

On a related question, I really like the recent changes to libpcap to
support the retrieval of different frame types from a given interface.
Has anybody made the hacks to ethereal to support this?  It sure would
be cool to have a pull-down list of the frame types supported by a given