Re: print 802.11

["Guy Harris" <guy () alum mit edu>]

axi wrote:

> My driver/card in monitor mode sends to libpcap a frame with FCS,
> when tcpdumps ( version 3.9.4 ) parsers i.e a valid Beacon Frame, it's
> identifies FCS part as a Tagged Parameter in a Management Body, and
> sometimes when pass TEST2 check, caused by that prints [|802.11] instead
> of Beacon.
> ¿ Is there anyway to automatically detect FCS in 802.11 frames ? ¿

Unfortunately, not in general.

The radiotap header does include a flag that indicates that the frame
includes an FCS, so *if* the driver you're using supplies a radiotap
header *and*, if it includes the FCS in the packet data, includes the "FCS
present" flag, tcpdump could (and should) be modified to treat the last 4
bytes of the frame (if the frame is full-length, i.e. if you don't use the
default snapshot length) as an FCS.

On the BSDs, most drivers use radiotap headers; I don't know whether any
of the BSD drivers include the FCS in the packet data or, if they do,
whether they set the appropriate flag in the radiotap header.

I think most Linux drivers don't use radiotap headers.

On what operating system are you running tcpdump?


-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.