Re: why libpcap cannot capture outbound 802.11 beacons?

[Max Filippov <jcmvbkbc () gmail com>]

Hi.

Looks like your mail has been delayed a bit.

> I am writing my own program, which will be running on a 802.11 AP, to capture all the outgoing beacons on the AP. But 
> I just noticed I cannot do it with the current libpcap: the program couldn't capture any outbound beacons. I've also 
> tried Wireshark which gave the same result.
>
> My questions are:
> 1. Can anyone shed some lights on the causes of what I saw?

Usually beacons are not sent as ordinary packets, so you cannot see
them on their egress interface.
Wireless driver is notified about beacon fields changes and can obtain
changed beacon pattern. Then it would usually put new beacon to the
dedicated NIC queue, and NIC firmware will care about broadcasting it
regularly and adjusting its timestamp/etc without interaction with
host.

Inability to see beacons is not libpcap issue, this is how mac80211 works.

> 2. Is there any user space method that I can capture the outbound beacons of a 802.11 AP on that specific AP (rather 
> than capturing on other PCs)? It is better for me if I can do this without hacking into the wireless driver.

I guess that the only way to capture beacons is via another wireless
interface, perhaps installed on the same AP.

-- 
Thanks.
-- Max
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.