Re: 802.11 + radio headers question...

[Eddie Harari <eddie.harari () gmail com>]

>  does it begin with IP headers or something preceds the IP headers ?
> >
>
> For data frames, the frame body begins with an IEEE 802.2 header, possibly
> followed by a SNAP header, followed by the payload for the protocol being
> carried over 802.11, such as IP.


 I did mean the Body part of the header, and i understand 802.2 precedes it,
how ever there is  something i am missing here...

 My data link type is 802.11_RADIO, when i sniff the packet and manipulate
the data i got on it i see that the IP header is 22 bytes away from the
DST_MAC.

 my question is:

 The IP header is 8 bytes into the body part of the 802.11 frame. 802.2 has
3 byte and snap is 5 byte long.

 the DST MAC is 4 byte into the 802.11 header (after FC and DURATION-ID ).

 the 802.11 header should be 24byte or 30byte ( 3 or 4 addresses ).

so the gap between the 802.11 header and the ip header should have been 29 /
35 byte.
in my case it is 26 byte offset.

anyone ?
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.