ath: a few questions [really kismet and radiotap]

[Sam Leffler]

Kris Maglione wrote:
> Sam Leffler wrote:
> 
>> Kris Maglione wrote:
>>
>>> Bruce M Simpson wrote:
>>>
>>>> On Tue, Jan 18, 2005 at 09:40:21AM -0500, Kris Maglione wrote:
>>>>  
>>>>
>>>>> Second, according to CVS, hw.ath.outdoors was made tunable a year 
>>>>> ago, but sysctl says it's readonly when I try to change it. It's 
>>>>> stuck at 1, which seems to be a possible explanation for why it's 
>>>>> indoor use sucks so badly compared to the windows driver, 
>>>>> especially through walls.
>>>>>   
>>>>
>>>>
>>>>
>>>>
>>>> I'm running 5.3-STABLE as of last Wednesday and do not see this sysctl.
>>>>
>>>> Please give version information (uname -a) when posting this kind of 
>>>> query,
>>>> as it's next to impossible to give useful advice otherwise.
>>>>  
>>>>
>>> Sorry about that. No uname -a, but it's the 5-STABLE from about a few 
>>> days ago. The kernel config file is actually the (minimally modified) 
>>> FreesBIE config file from a few months ago, but why is a long story.
>>
>>
>>
>> The setting is a read-only sysctl because once the module is loaded 
>> changing it has no effect.  Set it before you kldload the module or in 
>> your hints file if you want it different than the default.
>>
>>>
>>>> You should be able to 'tcpdump -i ath0 -y ieee802_11' to verify that 
>>>> you
>>>> can capture 802.11 packets straight off the card.
>>>>  
>>>>
>>> I have done that, and I have used kismet. My problem with kismet 
>>> turned out to just be a wierd way that kismet reports things.
>>
>>
>>
>> kismet has been broken for a while.  It used to work but something 
>> broke it and I've had no time to dig (it's painful to debug as it's a 
>> multi-process app written in C++ and makes heavy use of STL so 
>> inspecting data structures is a pain).

Against my better judgement I looked at kismet again :)  The problem is 
that kismet is discarding most all packets because it thinks they are 
corrupt.  The reason it thinks this is because the frames are being 
delivered to kismet with the trailing FCS intact and kismet interprets 
FCS as information elements and discards the packets when it validates 
the packet's contents.  While you likely don't care about the details, 
the fix is probably something that must go in kismet.  FWIW ethereal 
deals with this issue by having a checkbox in the UI that you can use to 
enable acceptance of such packets.

The radiotap format should have a flag to indicate FCS is included but 
it never happened.  I will discuss this (again) with the radiotap-meister.

	Sam