Re: Why "Monitor Mode" column still showed "n/a" when pcap_can_set_rfmon() function returns 1

[Pascal Quantin <pascal.quantin () gmail com>]

Hi Yang,

2016-05-17 19:02 GMT+02:00 Yang Luo <hsluoyb () gmail com>:

> Hi list,
>
> I'm using Wireshark 2.1.0-3054-gad4d0b8. I found that after I made
> pcap_can_set_rfmon() function in Npcap always return 1. The Capture
> Interfaces window still shows "n/a" in "Monitor Mode" column.
>
> J:\npcap\wpcap\libpcap\pcap.c:
>
> /*
>  * Returns 1 if rfmon mode can be set on the pcap_t, 0 if it can't,
>  * a PCAP_ERROR value on an error.
>  */
> int
> pcap_can_set_rfmon(pcap_t *p)
> {
> return 1;
> //return (p->can_set_rfmon_op(p));
> }
>
>
> I have analyzed the code flow:
>
>
> 1)
> https://github.com/wireshark/wireshark/blob/07fb53b063bcd4c2c67706cf7316b625efe0767e/ui/qt/capture_interfaces_dialog.cpp#L528
> ti->setText(col_monitor_, QString(device->monitor_mode_supported?
> (device->monitor_mode_enabled ? tr("enabled") : tr("disabled")) :
> tr("n/a")));
> The key is:
> device->monitor_mode_supported
>
> 2)
> https://github.com/wireshark/wireshark/blob/73957b4f44054a5f5fd013cf64b0bf80d8afd6e1/ui/qt/manage_interfaces_dialog.cpp#L599
> device.monitor_mode_supported = caps->can_set_rfmon;
> The key is:
> caps->can_set_rfmon
>
> 3)
> https://github.com/wireshark/wireshark/blob/07fb53b063bcd4c2c67706cf7316b625efe0767e/caputils/capture-pcap-util.c#L1021
> status = pcap_can_set_rfmon(pch);
> The key is:
> pcap_can_set_rfmon()
>
> So this call sequence shows that if pcap_can_set_rfmon() returns 1, the
> "Monitor Mode" column should show "enabled" or "disabled", not "n/a". So
> what am I missing here?

I just tested v2.1.0rc0-3090-g886e2bf with the following patch applied:
diff --git a/caputils/capture-wpcap.c b/caputils/capture-wpcap.c
index 5094375..e5a2661 100644
--- a/caputils/capture-wpcap.c
+++ b/caputils/capture-wpcap.c
@@ -495,6 +495,7 @@ int
 pcap_can_set_rfmon(pcap_t *a)
 {
        g_assert(has_wpcap);
+       return 1;
        if (p_pcap_can_set_rfmon != NULL) {
                return p_pcap_can_set_rfmon(a);
        }
        return 0;

And the Qt GUI correctly displays "disabled".
So presumably p_pcap_can_set_rfmon is NULL.

Is pcap_can_set_rfmon() symbol exported by your wpcap.dll? Can you share a
npcap test build?

Regards,
Pascal.

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe