Wireshark · Ethereal-users: Re: [Ethereal-users] Found Ethernet headers in a wireless NIC card.

[Guy Harris <gharris@xxxxxxxxx>]

Mahesh Krishnan wrote:

> But when I used ethereal to sniff the card It was actually reporting Ethernet
> headers and not 802.11 headers. One can understand if there was neither 802.11
> or ethernet headers because the card is not in monitor mode.

Eh?  If the card's not in monitor mode, at least on Linux one should, in 
general, expect Ethernet headers, not "neither 802.11 nor Ethernet 
headers" - 802.11 adapters and drivers tend to pretend (except on 
{Free,Net}BSD) that they're Ethernet adapters, and tend to supply 
Ethernet headers, unless you're in monitor mode.  (On newer FreeBSD and 
NetBSD, a driver can specify more than one link-layer header type that 
it can supply, and an application can specify which one of those it 
wants; newer versions of libpcap have APIs to get the list of link-layer 
header types and select a header type, and Ethereal uses that - you 
select the header type from the option menu in the "Capture Options" 
dialog box.  Perhaps Linux should consider adopting this model....)

> Is this a bug in ethereal.

No.  It's a characteristic of Linux 802.11 drivers.