Re: [tcpdump-workers] enquire about the tcpdump

easuring the range over the air (i.e., on WLAN) or over wire? How many hops from station to station? Do you need to get an "instant" range fix, or can you integrate for a while? Dave -- David Young OJC Technologies dyo...@ojctech.com Urbana, IL * (217) 278-3933 - This

Re: [tcpdump-workers] Radio tap headers (DLT 127)

of the > radiotap information preceding the 802.11 frame, > and 2 bytes prior to byte 3 should be set to 0 , ( version, and pad ). The length field is 16 bits wide (two bytes) and little-endian. Dave -- David Young OJC Technologies dyo...@ojctech.com Urbana, IL * (217) 278-39

Re: [tcpdump-workers] 802.11 + radio headers question...

he radio header. For example, DLT_IEEE802_11_RADIO requests a radio header in radiotap format. Dave -- David Young OJC Technologies dyo...@ojctech.com Urbana, IL * (217) 278-3933 - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] Hardware timestamp ?

h nanosecond timestamps, we might be able to help you better. :-) Dave -- David Young OJC Technologies dyo...@ojctech.com Urbana, IL * (217) 278-3933 - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] DLT for Radiotap+WiMAX?

a. Be sure to join the radiotap list, <http://che.ojctech.com/mailman/listinfo/radiotap>. That's the place to pitch WiMAX extensions. Dave -- David Young OJC Technologies [EMAIL PROTECTED] Urbana, IL * (217) 278-3933 - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] how to make the sniffer quicker?

e linux command ping > -f, if I send X in one second I cannot get this number of packets in the > sniffer, I always get less, around the 10%. At what rate does the sniffer receive packets? Could it be that ping -f produces packets faster than the radio can transmit them? That is, the packe

Re: [tcpdump-workers] radiotap on linux

On Wed, Jun 14, 2006 at 01:04:05PM -0500, Matthew Belcher wrote: > On Wednesday 14 June 2006 12:38, David Young wrote: > > > Are you sure this is a radiotap capture? Where it says "link-type > > IEEE802_11," it should say "link-type IEEE802_11_RADIO". Perha

Re: [tcpdump-workers] radiotap on linux

ure? Where it says "link-type IEEE802_11," it should say "link-type IEEE802_11_RADIO". Perhaps the driver is really creating a radiotap capture, but it uses the wrong DLT? Radiotap headers had better not be formatted differently in Linux, or else Linux is not compliant with t

Re: [tcpdump-workers] where does PCAP timestamp before or after the MAC scheduler?

idolgoz?s m?r > 25,- Ft-t?l > FotoMarket, m?r 5 ?ve az ?n fot?szolg?lat?ban! www.fotomarket.hu > > > - > This is the tcpdump-workers list. > Visit https://lists.sandelman.ca/ to unsubscribe. -- David Young OJC Technologies [EMAIL PROTECTED] Urbana, IL * (217) 278-3933 - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

[tcpdump-workers] RFC: 802.11 capture patch

completely rewrote the IE parser, parse_elements(). The old one was unnecessarily complicated. It also looked to me like it might be susceptible to buffer overruns. Dave -- David Young OJC Technologies [EMAIL PROTECTED] Urbana, IL * (217) 278-3933 - This is the tcpdump-workers

Re: [tcpdump-workers] RFC: 802.11 capture patch

On Fri, Mar 24, 2006 at 10:06:25PM -0600, David Young wrote: > This patch adds support for the extended rates 802.11 Information Element > (IE), changes a couple of u_char fields to u_int8_t, makes struct rates_t > store 15 rates (sort of arbitrary, that), and displays both truncated &g

Re: [tcpdump-workers] tcpdump - prism headers

in practice, it is virtually always 64 bytes; this is an accomodation for libpcap/tcpdump, which historically could not handle variable-length headers. (I haven't been paying close attention to notice whether libpcap/tcpdump supports variable lengths, now.) Dave -- David Young OJC Technologies [EMAIL PROTECTED] Urbana, IL * (217) 278-3933 - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] radio header 802.11

ilarly. In NetBSD, I know for certain that ath, atw, rtw, and wi provide radio headers in all modes. I believe atu, ipw, iwi, and ral do, too. Dave -- David Young OJC Technologies [EMAIL PROTECTED] Urbana, IL * (217) 278-3933 - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] preperation for 3.9 branch

;s no radio header or one of the various radio headers.) I think that link[M:N] filters should skip the radio header, but I think that users will want to test both radio headers and link-level headers. For example, I may want to filter based on Rx antenna, or else set a threshold Rx signal strength abov

Re: [tcpdump-workers] "final" radiotap patch for tcpdump

s?] I'm getting WAY ahead of myself. First thing is to wrap up importing tcpdump into NetBSD. Next is to find more free time for 802.11 hacking. Dave > > - > This is the tcpdump-workers list. > Visit https://lists.sandelman.ca/ to unsubscribe. -- David Young OJC T

Re: [tcpdump-workers] "final" radiotap patch for tcpdump

cannot predict what those headers will be. Instrumentation for network stacks? (Hmm.) "Crypto meta-data" ? Dave -- David Young OJC Technologies [EMAIL PROTECTED] Urbana, IL * (217) 278-3933 - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

[tcpdump-workers] imported radiotap (DLT_IEEE802_11_RADIO)

I checked in the sources for radiotap yesterday. Dave -- David Young OJC Technologies [EMAIL PROTECTED] Urbana, IL * (217) 278-3933 - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

[tcpdump-workers] libpcap lint

calls were followed by /*NOTREACHED*/ I will send a patch that gets rid of the lint. Dave -- David Young OJC Technologies [EMAIL PROTECTED] Urbana, IL * (217) 278-3933 - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.

[tcpdump-workers] "final" radiotap patch for tcpdump

capture in the native byte-order, but I haven't figured out how to interpret saved-packet files of different endianness.) Dave -- David Young OJC Technologies [EMAIL PROTECTED] Urbana, IL * (217) 278-3933 radiotap.tgz Description: GNU Zip compressed data ? cpack.c ? cp

Re: [tcpdump-workers] anoncvs down?

On Wed, Jul 21, 2004 at 05:38:50PM -0500, David Young wrote: > On Wed, Jul 21, 2004 at 06:26:35PM -0400, Michael Richardson wrote: > > -BEGIN PGP SIGNED MESSAGE- > > > > > > >>>>> "David" == David Young <[EMAIL PROTECTED]> writes

Re: [tcpdump-workers] anoncvs down?

On Wed, Jul 21, 2004 at 06:26:35PM -0400, Michael Richardson wrote: > -BEGIN PGP SIGNED MESSAGE- > > > >>>>> "David" == David Young <[EMAIL PROTECTED]> writes: > David> cvs.tcpdump.org does not seem to work any longer. It has not &g

[tcpdump-workers] anoncvs down?

messages if any) % cvs -q update -dP cvs [update aborted]: end of file from server (consult above messages if any) % cat CVS/Root :pserver:[EMAIL PROTECTED]:/tcpdump/master Dave -- David Young OJC Technologies [EMAIL PROTECTED] Urbana, IL * (217) 278-3933 - This is the tcpdump