monitor mode APs and bpf DLTs

[Martin Husemann]

On Mon, May 24, 2021 at 02:19:20PM +0200, Martin Husemann wrote:
> Hey folks,
> 
> I am slightly confused about the bpf details for wireless devices.

... and once you have seen it work, it all unriddles.

So I made two errors:

 - I picked run(4) as a test example, but radiotap support (kinda obvious
   once you think of it) is device dependent - and the run driver does
   not support it. The device driver needs to set ic_th (the tap header
   and properly initialize the length field before finalizing attachment.
 - I was confused by the mumbling of tcpdump about monitor mode and
   somehow assumed different/more link layer types would be available
   in monitor mode (which IIUC [now] never is the case in FreeBSD) and then 
   totaly confused radiotap bpf access with monitor mode VAPs, but of
   course they are orthogonal/independent.

Sorry for the noise.

Martin