tcpdump mailing list archives
problem while examinate 802.11-packets
From: "Christian Stalp" <christian.stalp () gmx de>
Date: Thu, 14 Feb 2008 19:02:47 +0100
Hello out there, I have a big problem to read incoming wlan-packets with pcap-library. First I introduced my program the ieee_802_11_header struct for casting: struct ieee_802_11_header { __u16 frame_control; // needs to be subtyped __u16 duration; __u8 mac1[6]; __u8 mac2[6]; __u8 mac3[6]; __u16 SeqCtl; __u8 mac4[6]; __u16 gapLen; __u8 gap[8]; } __attribute__ ((packed)); Then, I defined a filter for every packet that is been retransmited: char filter_exp[] = "wlan[0:2] & 0xF1 != 0"; I defined the device, it's a atheros-wlan interface: dev = "ath0"; and did this: pcap_lookupnet(dev, &net, &mask, errbuf); handle = pcap_open_live( dev, snaplen, promisc, to_ms, errbuf) And now the first weired thing: if I check my interface for ethernet it passes, if I check for wlan it fails! if (pcap_datalink(handle) != DLT_EN10MB) { perror("is not an Ethernet\n"); exit(EXIT_FAILURE); } if (pcap_datalink(handle) != DLT_IEEE802_11) { perror("is not an WLAN\n"); exit(EXIT_FAILURE); } So my program only runs if I commend out the second if-brach. pcap_compile(handle, &fp, filter_exp, 0, net) pcap_setfilter(handle, &fp) pcap_loop(handle, num_packets, packet_received, NULL); I want to distinguish that I checked everey call for exceptions, return of NULL, or other error-codes! So now my capture-routine: void packet_default(u_char *args, const struct pcap_pkthdr *header, const u_char *packet) { char insertvalues[256]; memset (insertvalues, 0x0, 256 ); struct ieee_802_11_header *wptr; //net/802_11.h if( ( wptr = calloc(1, sizeof(struct ieee_802_11_header)) ) == NULL ) { perror ("Fehler beim Reservieren des Speichers fuer die 802_11-Struktur\n"); exit(EXIT_FAILURE); } wptr = (struct ieee_802_11_header *) packet; snprintf(insertvalues,255, "default: %s",ether_ntoa((struct ether_addr*)(wptr->mac1))); printf("%s\n", insertvalues); printf ("Habe Default-Packet empfangen!\n"); //mytraffic->num_frames++; } The problem is, that I get only a part of my mac-adress. The first and the second field are just trash, the last 4 field are really showing my mac-adresse, but only the first four fields of course! I also tried this with casting to ethernet-frames but came out with the same result. What is wrong here? Can anybody help? Thank you Gruss Christian -- Psssst! Schon vom neuen GMX MultiMessenger gehört? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- problem while examinate 802.11-packets Christian Stalp (Feb 14)
- Re: problem while examinate 802.11-packets Guy Harris (Feb 14)
- Re: problem while examinate 802.11-packets Christian Stalp (Feb 15)
- Re: problem while examinate 802.11-packets Guy Harris (Feb 15)
- Re: problem while examinate 802.11-packets Christian Stålp (Feb 16)
- Re: problem while examinate 802.11-packets Guy Harris (Feb 16)
- Re: problem while examinate 802.11-packets Christian Stalp (Feb 17)
- Re: problem while examinate 802.11-packets Christian Stalp (Feb 15)
- Re: problem while examinate 802.11-packets Christian Stalp (Feb 16)
- Re: problem while examinate 802.11-packets Guy Harris (Feb 16)
- Re: problem while examinate 802.11-packets Guy Harris (Feb 14)
- Re: problem while examinate 802.11-packets alexander medvedev (Feb 15)