Re: Radio tap headers (DLT 127)

[David Young <dyoung () pobox com>]

On Wed, May 13, 2009 at 05:49:32PM -0400, Eddie Harari wrote:
> Hello ,
>
>   I am sniffing packets and my nic is on monitor mode,
>   the DLT type i get from pcap is 127 which is RADIOTAP header...
>
>   from what i understood byte 3 on the header contains the length of the
> radiotap information preceding the 802.11 frame,
>   and 2 bytes prior to byte 3 should be set to 0 , ( version, and pad ).

The length field is 16 bits wide (two bytes) and little-endian.

Dave

-- 
David Young             OJC Technologies
dyoung () ojctech com      Urbana, IL * (217) 278-3933
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.