Re: capturing 802.11 frames with udp protocol..

[Peter Moody <peter () ucsc edu>]

don't forget that the payload might have '\0' characters in them which
printf will terminate on.  If you loop over the payload and replace
those characters with something else, you should be able to print the
resulting string.

-Peter

On Wed, 2003-07-16 at 07:53, M. Onur ERGiN wrote:
> Hi;
> I am quite new in these and implementing an adhoc
> routing algorithm in user-space of linux.
> I can capture some packets which are send from cisco
> 340 wireless clients. the packets simply include data
> of a simple udp program.
> I do the following:
> /***********************************
>   int size_MAC;       //size of the mac layer header (802.11
> or ethernet)
>       if(strcmp(dev,"eth1")==0)
>               size_MAC = sizeof(struct ieee_802_11_header)+2;
>       else size_MAC = sizeof(struct ether_header);
>   int size_ip = sizeof(struct ip);
>   //int size_tcp = sizeof(struct tcphdr);
>   int size_udp = sizeof(struct udphdr);
>   struct scanpac sp;
>   static int i =0;
>
>   printf("DEVICE: %s\n",dev);
>   printf("FONK!%d\n",i++);
>
>   if(strcmp(dev,"eth1")!=0)
>         eptr = (struct ether_header *)(data);
>       else ieee_802_11_hdr = (struct ieee_802_11_header
> *)(data+2);
>
>   ip = (struct ip *)(data + size_MAC);
>   udp = (struct udphdr *)(data + size_MAC + size_ip);
>   payload = (u_char *)(data + size_MAC + size_ip +
> size_udp);
> **********************************/
> in most of the times, I get the headers correctly (at
> least they seem so :) ) but can never get the payload.
>
> first, I cast the complete packet to a 802.11 header.
> then I cast the rest to an ip header and the rest to a
> udp header.
> but when I try to get the very last one (which is
> supposed  to be the payload) I see nothing on the
> screen using printf("%s...);
>
> any ideas?
>
> regards,
>
> Onur.
>
> __________________________________
> Do you Yahoo!?
> SBC Yahoo! DSL - Now only $29.95 per month!
> http://sbc.yahoo.com
> -
> This is the TCPDUMP workers list. It is archived at
> http://www.tcpdump.org/lists/workers/index.html
> To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe
-- 
Peter Moody                             <peter () ucsc edu>
Information Security Administrator      831/459.5409
Communications and Technology Services. http://mustard.ucsc.edu/pubkey
UC, Santa Cruz.
:wq

Attachment: signature.asc
Description: This is a digitally signed message part