Ethereal-users: Re: [Ethereal-users] link-layer type on linux

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 19 Feb 2004 00:37:22 -0800
On Thu, Feb 19, 2004 at 09:23:11AM +0100, Mathieu Lacage wrote:
> Actually, I took care of this by removing the installed libpcap and
> installing a libpcap 0.8 before rebuilding my ethereal (the abuot dialog
> indeed shows libpcap 0.8) but this does not seem to change anything to
> the output of ethereal in promicuous mode.

Note that *promiscuous* mode and *monitor* mode aren't the same thing. 
You only get radio headers in monitor mode.

Ethereal can turn promiscuous mode on using the standard libpcap API;
however, there is not (yet) a libpcap API for turning monitor mode on. 
(It's on my very long TODO list - there'll probably be a new routine for
opening captures, with several new arguments, including an
attribute/value list for network-type-specific options, e.g. monitor
mode and the like for 802.11.)

I think that, at least with reasonably modern Linux distributions and
drivers that support the wireless extensions, you turn monitor mode on
with

	iwconfig {device} mode Monitor

at least according to the RH 9 iwconfig man page on the FreeBSD Web
site.  To turn it off, I suspect you'd do

	iwconfig {device} mode {whatever the mode was before}