Mahesh Krishnan wrote:
Okay so this may anser some of my question. When are such packets discovered
by ethereal ?
This packet is definitely not on the WLAN.
"Not on the WLAN" in what sense?
If you mean "the packet does not appear on the WLAN in the exact form
that Ethereal sees it", that's true, as packets on the WLAN have 802.11
headers.
However, the packets Ethereal sees do correspond to packets that appear
on the WLAN.
Is the packet still somewhere in
the queue when ethereal sees these packets or
it sees the packet just before the 802.11 headers are added and the packets
are put on the wireless link.
If the packet is transmitted by the machine running Ethereal, the
packets are supplied to Ethereal (or whatever program is using
libpcap/WinPcap) before the 802.11 headers are added and the packets are
put on the wireless link.
If the packet is *received* by the machine running Ethereal, the packets
are supplied to Ethereal *after* they've been put on the wireless link
and received by the machine in question; the wireless card and/or the
wireless card driver has *removed* the 802.11 headers and *added* an
Ethernet header. (That's done so that
1) less driver work is required;
2) on Windows, whose networking stack expects Ethernet-like packets,
the packets can be processed by the networking stack.)