Wireshark · Ethereal-users: Re: [Ethereal-users] Source MAC address while capturing with wirelessdevice

["Gentoo_Newbie" <gentoo_newbie@xxxxxxxxxx>]

Hello and thanks for answering.

In fact, I am using Ubuntu 6.04.
I have a centrino with a w2200 wireless card using the iwp2200 module (i 
think it's how it's written).
This is very weird, because although all packets I capture with ethereal say 
I have a mac aa:aa:03:00:00:00, when I capture received packets they have 
the correct destination (my true MAC). So I suspected it has something to do 
with Ethereal itself or maybe pcap?

Thanks

----- Original Message ----- 
From: "Guy Harris" <gharris@xxxxxxxxx>
To: "Ethereal user support" <ethereal-users@xxxxxxxxxxxx>
Sent: Saturday, January 14, 2006 8:28 AM
Subject: Re: [Ethereal-users] Source MAC address while capturing with 
wirelessdevice


> Gentoo_Newbie wrote:
>
> > I am doing captures with Ethereal with my wireless device. Can anyone 
> > tell me why my source MAC address is aa:aa:03:00:00:00 ?
>
> Because the driver is supplying packet headers that don't match the 
> ARPHRD_ type, or is supplying a fake MAC address.  aa:aa:03 is the LLC 
> header for a SNAP packet, and 00:00:00 is an OUI, which would follow the 
> LLC header in a SNAP packet, and it'd indicate that what follows is an 
> Ethernet type value.
>
> Perhaps the driver or the card is supplying a fake Ethernet header, 
> although, given that 802.11 packet have destination and source MAC 
> addresses, I'm not sure why it's doing it in that fashion.
>
> What type of wireless device do you have?  (I assume from your e-mail name 
> that the machine is running Gentoo Linux.)
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users