Wireshark · Ethereal-users: Re: [Ethereal-users] Re:Found Ethernet headers in a wireless NIC card.

[Guy Harris <gharris@xxxxxxxxx>]

Mahesh Krishnan wrote:

> Okay so this may anser some of my question. When are such packets discovered
> by ethereal ?
>
> This packet is definitely not on the WLAN.

"Not on the WLAN" in what sense?

If you mean "the packet does not appear on the WLAN in the exact form 
that Ethereal sees it", that's true, as packets on the WLAN have 802.11 
headers.

However, the packets Ethereal sees do correspond to packets that appear 
on the WLAN.

> Is the packet still somewhere in
> the queue when ethereal sees these packets or 
> it sees the packet just before the 802.11 headers are added and the packets
> are put on the wireless link.

If the packet is transmitted by the machine running Ethereal, the 
packets are supplied to Ethereal (or whatever program is using 
libpcap/WinPcap) before the 802.11 headers are added and the packets are 
put on the wireless link.

If the packet is *received* by the machine running Ethereal, the packets 
are supplied to Ethereal *after* they've been put on the wireless link 
and received by the machine in question; the wireless card and/or the 
wireless card driver has *removed* the 802.11 headers and *added* an 
Ethernet header.  (That's done so that

	1) less driver work is required;

	2) on Windows, whose networking stack expects Ethernet-like packets, 
the packets can be processed by the networking stack.)