Ethereal-users: Re: [Ethereal-users] IEEE 802.11 MAC-layer information retrieval

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Sun, 02 Oct 2005 10:49:53 -0700
Achilles Tziatzios wrote:
Hi, I would like to know if it is possible with Ethereal to capture information concerning the MAC layer retransmissions of packets as well as packet headers information in the MAC layer, for a wireless IEEE 802.11b network.

If you want to capture packets with 802.11 headers, rather than fake Ethernet headers, you'll need to be running on sufficiently recent versions of Linux or of one of the free-software BSDs; see the page whose URL Ulf Lamping provided. Capturing 802.11 headers on other operating systems, such as Windows or Mac OS X, is *not* supported, as those OSes don't offer any mechanism to allow libpcap/WinPcap to capture them.

If you want to see 802.11 retransmissions, you might have to do a "third-party" promiscuous or monitor-mode capture; you probably won't see them if you're capturing on the machine doing the retransmissions (at least not if they're being done by the 802.11 adapter, as capturing of outgoing traffic is done at the software level before packets are supplied to the adapter) or the machine to which the retransmissions are being done (at least not if the 802.11 adapter recognizes them and ignores them, or if the reason retransmissions are being done is that the receiving machine didn't receive and acknowledge the original transmission).

At least on Linux, you'll probably have to capture in monitor mode *anyway* in order to see 802.11 headers.