Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Monitor mode using FreeBSD

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 22 Jan 2007 11:59:41 -0800
david lopez wrote:

Im using tshark (tshark -i ath0) in FreeBSD 6.2

What happens with

	tshark -i ath0 -y IEEE802_11

(or -y IEEE802_11_RADIO)?

Im using one atheros wlan card (proxim 8470wd) for capturing packets in monitor mode (ifconfig ath0 monitor), but when Im sending ping between one sender and one receiver, Im only able to capture the reply packets and Im not able to capture the request packets or the management packets like RTS, CTS, Acknowledges, ... What I'm doing wrong? I was doing the same in linux suse 10 and I had no problems.

On Linux, there's no mechanism to let an application or library select a link-layer header type; for what I presume is either backwards compatibility or hardware restrictions, I think most 802.11 adapters default to providing "fake Ethernet" link-layer headers, with the only way to get native 802.11 headers being to switch to monitor mode.

On modern BSDs, the BPF mechanism lets you choose a link-layer header type; this is supported by most 802.11 adapters. Those adapters default to "(fake) Ethernet" for backwards compatibility, and you have to choose native 802.11 headers explicitly - even in monitor mode. I suspect only data frames are supplied to BPF listeners that have "Ethernet" as the link-layer header type.

Arguably, Wireshark should default to requesting native 802.11 headers rather than Ethernet headers.