Wireshark mailing list archives
Re: [tcpdump-workers] regarding wireless data frames
From: Guy Harris <guy () alum mit edu>
Date: Fri, 9 Mar 2012 16:09:35 -0800
On Mar 8, 2012, at 4:47 PM, abhinav narain wrote:
hi, I have seen tcpdump,wireshark both just print packet contents till mac header in monitor mode. In case of normal wireless interfaces (wlan0), they follow a different execution path. Can someone tell me what should I expect in the the frame after ieee80211_hdr (which comes after the radiotap header) ? According to my knowledge, I assume if the control frame bit with Is it an llc header with a general format : struct llc_hdr { uint8 dsap; uint8 ssap; struct { uint8 ui; uint8 org_code[3]; uint16 ether_type; } snap; }; so that i can jump it and get the ip header ?
Oh, and one more thing: Some network adapters, when running in a mode where they supply an 802.11 header (such as monitor mode), put some padding in between the 802.11 header and the payload, so the 802.2 LLC header in a data frame might not immediately follow the 802.11 header (regardless of whether the payload is encrypted or not). The radiotap header includes a flag for that - it's the 0x20 flag bit in the Flags field: http://www.radiotap.org/defined-fields/Flags ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- regarding wireless data frames abhinav narain (Mar 08)
- Re: [tcpdump-workers] regarding wireless data frames Guy Harris (Mar 08)
- Re: [tcpdump-workers] regarding wireless data frames Guy Harris (Mar 08)
- Re: [tcpdump-workers] regarding wireless data frames abhinav narain (Mar 08)
- Re: [tcpdump-workers] regarding wireless data frames abhinav narain (Mar 08)
- Re: [tcpdump-workers] regarding wireless data frames Guy Harris (Mar 09)
- Re: [tcpdump-workers] regarding wireless data frames Guy Harris (Mar 08)
- Re: [tcpdump-workers] regarding wireless data frames Mike Kershaw (Mar 09)
- Re: [tcpdump-workers] regarding wireless data frames Guy Harris (Mar 09)
- Re: [tcpdump-workers] regarding wireless data frames abhinav narain (Mar 10)
- Re: [tcpdump-workers] regarding wireless data frames Guy Harris (Mar 10)
- Re: [tcpdump-workers] regarding wireless data frames abhinav narain (Mar 11)
- Re: [tcpdump-workers] regarding wireless data frames abhinav narain (Mar 11)
- Re: [tcpdump-workers] regarding wireless data frames abhinav narain (Mar 13)
- Re: [tcpdump-workers] regarding wireless data frames abhinav narain (Mar 10)
- Re: [tcpdump-workers] regarding wireless data frames Guy Harris (Mar 08)