Re: pcap filter for 802.11

[Guy Harris <guy () alum mit edu>]

On Sat, Apr 24, 2004 at 07:21:59PM +0530, Chen Hsia Lee wrote:
> I tried to set the wireless card into monitor mode using:
>       iwconfig eth1 mode Monitor
> The error it gave was:
>       Error for wireless request "Set Mode" (8B06):
>       SET failed on device eth1: Invalid argument

The Aironet driver (the driver normally used on Linux for the Cisco
cards; Cisco bought Aironet) doesn't, as far as I know, support the
wireless extensions, and I think that's what "iwconfig" uses to
configure monitor mode.

> I also tried changing the Config file using
>       echo: "Mode=rfmon" > /proc/driver/ethN/Config
> (from the ethereal FAQ) but it did not work.

Some versions of the Linux Aironet driver support that; some other
versions might require you to, instead, capture on "wifi1" to capture in
monitor mode, or so I infer from

        http://www.kismetwireless.net/documentation.shtml

It would be Really Wonderful if the Aironet drivers for Linux used the
same wireless-extension stuff that at least some other wireless drivers
do.  It would be Even More Wonderful if *all* the 802.11 drivers in
Linux worked the same way when it came to turning on monitor mode,
supplying 802.11 rather than Ethernet headers, etc. (and probably still
*more* wonderful if *all* the 802.11 control stuff worked the same with
all drivers).

(It would also be Really Wonderful if all the 802.11 drivers in FreeBSD
and NetBSD supported the new 802.11 ioctl stuff and BPF stuff in FreeBSD
5.2 and NetBSD-current, and if the remaining BSDs picked that up.)
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.