Question on IEEE802_11_RADIO

[Richard Bejtlich]

Hello,

>From what I've read elsewhere on the lists, I'm not
seeing what I should using the new IEEE802_11_RADIO
link type.  Tcpdump is compiled --WITH_RADIOTAP:

--
orr:/root# uname -a
FreeBSD orr.taosecurity.com 5.2-SECURITY FreeBSD
5.2-SECURITY #0: Thu Feb  5 10:24:52 GMT 2004    
root at builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC
 i386

orr:/root# /usr/local/sbin/tcpdump -V
tcpdump version 3.8
libpcap version 0.8

orr:/root# ifconfig wi0 mediaopt monitor channel 6 up

orr:/root# ifconfig wi0
wi0:
flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu
1500
        inet6 fe80::204:e2ff:fe29:3bba%wi0 prefixlen
64 scopeid 0x4 
        ether 00:04:e2:29:3b:ba
        media: IEEE 802.11 Wireless Ethernet
autoselect <monitor> (DS/2Mbps <monitor>)
        status: associated
        ssid ""
        stationname "FreeBSD WaveLAN/IEEE node"
        channel 6 authmode OPEN powersavemode OFF
powersavesleep 100
        wepmode OFF weptxkey 1

orr:/root# /usr/local/sbin/tcpdump -L -i wi0
Data link types (use option -y to set):
  EN10MB (Ethernet)
  IEEE802_11 (802.11)
  IEEE802_11_RADIO (802.11 plus radio information
header)

orr:/root# /usr/local/sbin/tcpdump -ne -i wi0 -y
IEEE802_11_RADIO -vv -s 1515 
tcpdump: data link type IEEE802_11_RADIO
tcpdump: WARNING: wi0: no IPv4 address assigned
tcpdump: listening on wi0, link-type IEEE802_11_RADIO
(802.11 plus radio information header), capture size
1515 bytes
17:23:44.825895 [|802.11]
17:23:44.851368 [|802.11]
17:23:44.869122 [|802.11]
17:23:44.888504 [|802.11]

I do see what I expect using IEEE802_11:

orr:/root# /usr/local/sbin/tcpdump -n -i wi0 -y
IEEE802_11 -vv -s 1515 -X
tcpdump: data link type IEEE802_11
tcpdump: WARNING: wi0: no IPv4 address assigned
tcpdump: listening on wi0, link-type IEEE802_11
(802.11), capture size 1515 byte
s
12:26:25.851579 0us Beacon (LIMHOME) [1.0* 2.0* 5.5
11.0 Mbit] ESS CH: 6
0x0000   2571 61c2 d900 0000 6400 0500 0007 4c49      
 %qa.....d.....LI
0x0010   4d48 4f4d 4501 0482 840b 1603 0106 0406      
 MHOME...........
0x0020   0102 0000 0000 0504 0001 0000                
 ............
12:26:25.910662 0us Beacon (shaolin) [1.0* 2.0* 5.5*
11.0* Mbit] ESS CH: 6, PRIVACY
0x0000   2cc2 0ac7 7d04 0000 6400 1100 0007 7368      
 ,...}...d.....sh
0x0010   616f 6c69 6e01 0482 848b 9603 0106 0504      
 aolin...........
0x0020   0001 0000   

-- 

Anyone else seeing similar behavior?

Thank you,

Richard
http://www.taosecurity.com

__________________________________
Do you Yahoo!?
Get better spam protection with Yahoo! Mail.
http://antispam.yahoo.com/tools