Ethereal-users: Re: [Ethereal-users] link-layer type on linux

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Mathieu Lacage <Mathieu.Lacage@xxxxxxxxxxxxxxx>
Date: Thu, 19 Feb 2004 10:15:39 +0100
On Thu, 2004-02-19 at 09:23, Mathieu Lacage wrote:
> > The madwifi driver supplies, in monitor mode, an ARPHRD_ type of
> > ARPHRD_IEEE80211_PRISM.  That ARPHRD_ value is *NOT* supported by any
> > libpcap releases prior to 0.7.2.  If your Linux distribution comes with a
> > pre-0.7.2 version of libpcap, then Ethereal will probably be linked with
> > it, and will therefore be unable to capture in monitor mode on an Atheros
> > interface; you would have to get a newer version of libpcap.
> 
> Actually, I took care of this by removing the installed libpcap and
> installing a libpcap 0.8 before rebuilding my ethereal (the abuot dialog
> indeed shows libpcap 0.8) but this does not seem to change anything to
> the output of ethereal in promicuous mode. I believe I need to figure
> out how the radio header is supposed to be transfered to userspace to
> debug this.

Stupid me. It works now: you need to set the device in monitor mode,
create a network device from this device and capture in promiscuous
mode.

thanks for your help,
Mathieu
-- 
Mathieu Lacage <mathieu.lacage@xxxxxxxxxxxxxxx>