Subject: Re: issues with 802.11 radiotap
To: Sam Leffler <firstname.lastname@example.org>
From: Matthias Drochner <M.Drochner@fz-juelich.de>
Date: 07/12/2005 21:07:10
> I think you're using an old version of ethereal; I've been able to set
> a config option through the GUI to indicate rx'd frames have FCS
I've found it -- it is in the per-protocol preferences
section -- I'd rather expect this in a per-interface setup.
Anyway, it is not very helpful: FCS is only present on receive
with the ural driver; when I check that button I get all sent
frames marked "malformed" instead...
> OTOH it would be good for tools to honor the
> radiotap flag
Definitely. At least on NetBSD, the FCS is not included in
packets captured with IEEE801_11 linktype, so the radiotap
information is present when needed.
(And since the check is done in hardware anyway as I understand
it it is dispensable.)
> > Outer header?
> He's referring to the fixed length field at the front of radiotap data.
Yep -- just to keep the processing minimal to get at the ieee802_11
> >>The _radiotap link later type isn't widely used yet, so I'd
> >>propose to correct for these problems as soon as possible.
> Actually this is not true; it's rather widely used and the latest
> libpcap even knows how to build bpf programs to do in-kernel filtering.
OK, didn't see this. Btw, I've just tried the latest libpcap (0.9.1).
Builds out of the box, but then can't deal with multiple link
types. Didn't look deeper.