Wireshark · Wireshark-dev: Re: [Wireshark-dev] Why "Monitor Mode" column still showed "n/a" when pcap_can_set_rfmon() function

[Pascal Quantin <pascal.quantin@xxxxxxxxx>]

Hi Yang,

2016-05-17 19:02 GMT+02:00 Yang Luo <hsluoyb@xxxxxxxxx>:

Hi list,

I'm using Wireshark 2.1.0-3054-gad4d0b8. I found that after I made pcap_can_set_rfmon() function in Npcap always return 1. The Capture Interfaces window still shows "n/a" in "Monitor Mode" column.

J:\npcap\wpcap\libpcap\pcap.c:

/*

 * Returns 1 if rfmon mode can be set on the pcap_t, 0 if it can't,

 * a PCAP_ERROR value on an error.

 */

int

pcap_can_set_rfmon(pcap_t *p)

{

return 1;

//return (p->can_set_rfmon_op(p));

}

I have analyzed the code flow:

1) https://github.com/wireshark/wireshark/blob/07fb53b063bcd4c2c67706cf7316b625efe0767e/ui/qt/capture_interfaces_dialog.cpp#L528

ti->setText(col_monitor_, QString(device->monitor_mode_supported? (device->monitor_mode_enabled ? tr("enabled") : tr("disabled")) : tr("n/a")));

The key is:

device->monitor_mode_supported

2) https://github.com/wireshark/wireshark/blob/73957b4f44054a5f5fd013cf64b0bf80d8afd6e1/ui/qt/manage_interfaces_dialog.cpp#L599

device.monitor_mode_supported = caps->can_set_rfmon;

The key is:

caps->can_set_rfmon

3) https://github.com/wireshark/wireshark/blob/07fb53b063bcd4c2c67706cf7316b625efe0767e/caputils/capture-pcap-util.c#L1021

status = pcap_can_set_rfmon(pch);

The key is:

pcap_can_set_rfmon()

So this call sequence shows that if pcap_can_set_rfmon() returns 1, the "Monitor Mode" column should show "enabled" or "disabled", not "n/a". So what am I missing here?

I just tested v2.1.0rc0-3090-g886e2bf with the following patch applied:
diff --git a/caputils/capture-wpcap.c b/caputils/capture-wpcap.c
index 5094375..e5a2661 100644
--- a/caputils/capture-wpcap.c
+++ b/caputils/capture-wpcap.c
@@ -495,6 +495,7 @@ int
 pcap_can_set_rfmon(pcap_t *a)
 {
        g_assert(has_wpcap);
+       return 1;
        if (p_pcap_can_set_rfmon != NULL) {
                return p_pcap_can_set_rfmon(a);
        }

        return 0;

And the Qt GUI correctly displays "disabled".

So presumably p_pcap_can_set_rfmon is NULL.

Is pcap_can_set_rfmon() symbol exported by your wpcap.dll? Can you share a npcap test build?

Regards,

Pascal.