Ethereal-dev: Re: [Ethereal-dev] help neede about WLAN sniffer

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 30 Sep 2004 23:16:32 -0700
akshar SNIFFER wrote:

I tried to capture raw 802.11b packets using libpcap library ,but i
did not get it( i got 802.3 packets).I used Intersil prism chip set 11g
card.Is there any private ioctl's ,using which i can  take the raw 802.11b
packets directly from WLAN card.

On Linux, I think at least some of the 802.11 drivers won't supply packets with 802.11 headers unless the interface is in monitor mode.

The way you put an interface into monitor mode depends, at least to some degree, on the interface. This FAQ entry:

	http://www.ethereal.com/faq#q5.38

discusses how that's done at the command line; the commands in question put the interface into monitor mode using ioctls, or files in "/proc", or whatever.

Note, though, that if you're not in monitor mode, I think most Linux drivers might supply only data frames, not management frames (much less control frames), in which case there's not much information lost by not getting raw 802.11 headers.