Re: [tcpdump-workers] Format of libpcap packet

2015-03-29 Thread Guy Harris
On Mar 28, 2015, at 9:16 PM, Jesse Johnson wrote: > Can you recommend a text that explains layer 2 networking a little more > succinct than the IEEE standards? Unfortunately, no; I've always used the standard when working on code to dissect 802.11 frames. _

Re: [tcpdump-workers] Format of libpcap packet

2015-03-28 Thread Jesse Johnson
Awesome! Exactly what I was looking for. I appreciate the great references. I looked over the code and saw the references for different frame types, but couldn't piece it together. Can you recommend a text that explains layer 2 networking a little more succinct than the IEEE standards? Thank

Re: [tcpdump-workers] Format of libpcap packet

2015-03-28 Thread Guy Harris
On Mar 28, 2015, at 5:46 PM, Jesse Johnson wrote: > I am dissecting pcap packets generated by airodump-ng using libpcap and I > seem to be offset on the access of the Ethernet fram. You're assuming here that you *have* Ethernet frames. "airo" refers to "the air", as in "over the air", as in

[tcpdump-workers] Format of libpcap packet

2015-03-28 Thread Jesse Johnson
Hi, I am dissecting pcap packets generated by airodump-ng using libpcap and I seem to be offset on the access of the Ethernet fram. I am using the call pcap_next_ex() and working with the returned ethernet packet. I read the first destination and source MACs into a C array and they both seem