[tcpdump-workers] new DLT values

2008-02-15 Thread Hannes Kälber
Hello, we are currently working on the integration of wireshark into our datalogger toolchain. For that purpose, we need some new DLT values. Since we are capturing automotive busses, such as CAN, Flexray, Most and LIN, I suggest that these busses get there own DLTs. I suggest the names DLT_FL

Re: [clearview-discuss] [tcpdump-workers] libdlpi with libpcap

2008-02-15 Thread Guy Harris
On Feb 13, 2008, at 6:14 PM, sagun shakya wrote: Updated webrev can be found at: http://cr.opensolaris.org/~sagun/libpcap-review2/ It says, in a comment you added to configure.in: + # Due to a gcc bug (6619485), the default search path for 32-bit + # libraries does not inclu

Re: [clearview-discuss] [tcpdump-workers] libdlpi with libpcap

2008-02-15 Thread Guy Harris
On Feb 13, 2008, at 6:14 PM, sagun shakya wrote: Updated webrev can be found at: http://cr.opensolaris.org/~sagun/libpcap-review2/ Why did you add a AC_CHECK_HEADERS(sys/bufmod.h) check to configure.in after the check for libdlpi? It's checked for later in the case statement if

Re: [tcpdump-workers] HELP: Errors compiling tcpdump-3.9.8

2008-02-15 Thread Guy Harris
On Feb 8, 2008, at 2:20 PM, Eric wrote: 2. I've downloaded/compiled flex-2.5.34, bison-2.3, and libpcap-0.9.8 [in /usr/local] beforehand. 3. When attempting to compile tcpdump-3.9.8 I get the following error: == /usr/local/lib/libpcap.a(pcap.o): In function `pcap_datalink_name

Re: [tcpdump-workers] problem while examinate 802.11-packets

2008-02-15 Thread Guy Harris
On Feb 15, 2008, at 2:15 AM, Christian Stalp wrote: I changed my capture-routine this way: void packet_default(u_char *args, const struct pcap_pkthdr *header, const u_char *packet) { char insertvalues[256]; memset (insertvalues, 0x0, 256 ); //struct ieee_802_11_heade

Re: [tcpdump-workers] problem while examinate 802.11-packets

2008-02-15 Thread Guy Harris
On Feb 15, 2008, at 4:52 AM, Christian Stalp wrote: But the result is the same. Its still the first four fields of my MAC-address but the final two are still trash. I.e., the first four octets of the source MAC address are valid and have the correct values (i.e., they match the MAC address

Re: [tcpdump-workers] problem while examinate 802.11-packets

2008-02-15 Thread Eloy Paris
On Fri, Feb 15, 2008 at 10:23:48AM -0600, alexander medvedev wrote: > to get 80211 frames you should be listening on the interface in the > monitor mode. > > i vaguely remember that on some cards it is done with "iwconfig" command. > not sure for atheros cards... [...] I've found the following p

Re: [tcpdump-workers] problem while examinate 802.11-packets

2008-02-15 Thread Christian Stalp
At this moment I do not want to change into the monitor-mode. I want to monitor the normal data-interchange. Without a malicious intend of course ;-) I want to track the retransfered packets, packets with the retry-field set. For that I set this filter expression: filter_exp[] = "wlan[0:2] & 0xF

Re: [tcpdump-workers] problem while examinate 802.11-packets

2008-02-15 Thread alexander medvedev
Christian, to get 80211 frames you should be listening on the interface in the monitor mode. i vaguely remember that on some cards it is done with "iwconfig" command. not sure for atheros cards... you should probably change dev = "ath0"; to dev = "wifi0"; in your program and u

Re: [tcpdump-workers] problem while examinate 802.11-packets

2008-02-15 Thread Christian Stalp
Hello Alexander, thanks for help I envoke tcpdump without parameters because ath0 is the default interface. Im in the normal mode for network transmission, no monitor! I receive and send packets, this mail goes also over this connection. So.. venus:/home/chris# tcpdump listening on wifi0, link-typ

Re: [tcpdump-workers] problem while examinate 802.11-packets

2008-02-15 Thread alexander medvedev
Christian, what happens, if you listen on the interface using tcpdump? do you get 802.11 frames or do you get ethernet frames? i.e. is RFMON on? -alexm 08:47 15/02/2008 On Fri, 15 Feb 2008, Christian Stalp wrote: > In the mean time I found some hint. > I did not told you that my program is m

Re: [tcpdump-workers] problem while examinate 802.11-packets

2008-02-15 Thread Christian Stalp
In the mean time I found some hint. I did not told you that my program is multithreaded, because I thought it doesn't matter. Accidentally I was stumble over the function "ether_ntoa_r". So I changed my capture-function (which is called by a thread!) to this: void packet_default(u_char *args, co

Re: [tcpdump-workers] problem while examinate 802.11-packets

2008-02-15 Thread Christian Stalp
Hello, thank you for your help. I changed my capture-routine this way: void packet_default(u_char *args, const struct pcap_pkthdr *header, const u_char *packet) { char insertvalues[256]; memset (insertvalues, 0x0, 256 ); //struct ieee_802_11_header *wptr; //net/802_11.h