Re: why libpcap cannot capture outbound 802.11 beacons?

[Guy Harris <guy () alum mit edu>]

On Nov 27, 2011, at 10:51 PM, Max Filippov wrote:

> Looks like your mail has been delayed a bit.

Yes, there was apparently a glitch in the mailing list.

> Usually beacons are not sent as ordinary packets, so you cannot see
> them on their egress interface.
> Wireless driver is notified about beacon fields changes and can obtain
> changed beacon pattern. Then it would usually put new beacon to the
> dedicated NIC queue, and NIC firmware will care about broadcasting it
> regularly and adjusting its timestamp/etc without interaction with
> host.

I.e., the beacons are broadcast directly by the firmware on the NIC without host intervention?  If so, then, as you 
note, that definitely means you won't see them through libpcap, or anything else that taps into the host networking 
code, as the packets don't go through the host networking code (whether it's Linux, as per your mention of mac80211, or 
*BSD or anything else running on the AP).

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.