Radio tap headers (DLT 127)

[Eddie Harari <eddie.harari () gmail com>]

Hello ,

  I am sniffing packets and my nic is on monitor mode,
  the DLT type i get from pcap is 127 which is RADIOTAP header...

  from what i understood byte 3 on the header contains the length of the
radiotap information preceding the 802.11 frame,
  and 2 bytes prior to byte 3 should be set to 0 , ( version, and pad ).

  is there anything i get which precedes the radiotap header ? or the
radiotap header is the very begining of the packet i am sniffing ?

 the reason i ask is because when i am trying to look for the length of the
radiotap header , and the version i get values that makes no sense...

anyone ?

thanks ,

E.h
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.