Wireshark · Ethereal-dev: Re: [Ethereal-dev] help needed about sniffing on WLAN

[Guy Harris <gharris@xxxxxxxxx>]

Martijn Schipper wrote:

> What kind of Prism card are you using? If you have an 11g/11a card then 
> that is correct. In promiscuous mode we encapsulate the 802.11 frame in 
> an 802.3 frame with an additional radio header.

...and presumably the only packets that are captured are data packets, 
so there's not much information lost by using the fake 802.3 headers.

If he wants to see more than just data packets, such as management 
packets, he'll have to capture in monitor mode; the Ethereal FAQ entry I 
sent him earlier discusses how to do so in Linux.