Subject: Re: issues with 802.11 radiotap
To: Sam Leffler <>
From: Matthias Drochner <>
List: tech-net
Date: 07/12/2005 21:07:10 said:
> I think you're using an old version of ethereal; I've been able to set
> a  config option through the GUI to indicate rx'd frames have FCS

I've found it -- it is in the per-protocol preferences
section -- I'd rather expect this in a per-interface setup.
Anyway, it is not very helpful: FCS is only present on receive
with the ural driver; when I check that button I get all sent
frames marked "malformed" instead...

> OTOH it would be good for tools to honor the 
> radiotap flag

Definitely. At least on NetBSD, the FCS is not included in
packets captured with IEEE801_11 linktype, so the radiotap
information is present when needed.
(And since the check is done in hardware anyway as I understand
it it is dispensable.)

> > Outer header?
> He's referring to the fixed length field at the front of radiotap data.

Yep -- just to keep the processing minimal to get at the ieee802_11

> >>The _radiotap link later type isn't widely used yet, so I'd
> >>propose to correct for these problems as soon as possible.
> Actually this is not true; it's rather widely used and the latest 
> libpcap even knows how to build bpf programs to do in-kernel filtering.

OK, didn't see this. Btw, I've just tried the latest libpcap (0.9.1).
Builds out of the box, but then can't deal with multiple link
types. Didn't look deeper.

best regards