> This is debian linux, powerpc, driver from pcmcia-cs 3.1.29, modified by
> me to use the rf monitoring mode of the aironet mac. It looks as though
> the first 10 or more bytes are some kind of header or other protocol info.
Yes, it's probably an 802.11 MAC header.
What ARPHRD_ value does the modified driver supply? If it's
ARPHRD_ETHER, and the driver is supplying an 802.11 MAC header rather
than an Ethernet header, not only will Ethereal fail to handle captures,
all other programs that read raw packets will do so.
It should, instead, supply ARPHRD_IEEE80211 if it's supplying 802.11 MAC
headers. See, for example, "drivers/net/wireless/airo.c" in the 2.4.9
kernel; the comment at the beginning says it's an "Aironet driver for
4500 and 4800 series cards", and the page at
http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Linux.Wireless.drivers.html
says that "airo.o" and "airo_cs.o" are drivers for the "Aironet ARLAN
4500, 4800, Cisco 340 and Cisco 350 series", so that might be the driver
(at least in 2.4[.x]) for your card.
If that's the same card, the driver seems to imply that the "receive
mode" configuration field on the card supports a variety of modes,
including "wireless monitor mode" (which has the value 3, which is in
the low bits of the receive mode field), *and* has a flag, which is the
bottommost bit in the upper byte of the 16-bit receive mode field, which
"disables 802.3 header on rx", which I infer means that received packets
have an 802.11 header, rather than a fake 802.3 header.
If that mode is turned on, the device's network type is set to
ARPHRD_IEEE80211 rather than ARPHRD_ETHER.
So if you're setting that flag, as well as going into wireless monitor
mode, you must arrange that the device's network type be
ARPHRD_IEEE80211. (If your kernel source tree doesn't define
ARPHRD_IEEE80211, you must modify it to define it as 801 - or must back
out your changes to set that flag, and give up on seeing raw 802.11
packets.)
I don't know what the card does if it's in wireless monitor mode but
doesn't have that flag set; I suggest you talk to the author of the
driver about that.