David Young wrote:
In principle, the radiotap header length is variable, but in practice, it
is virtually always 64 bytes; this is an accomodation for libpcap/tcpdump,
which historically could not handle variable-length headers. (I haven't
been paying close attention to notice whether libpcap/t
On Tue, Feb 21, 2006 at 06:51:11PM -0800, Guy Harris wrote:
>
> On Feb 21, 2006, at 6:42 PM, axi wrote:
>
> >When tcpdump receives a packet with prism headers recognized as above
> >:
> >
> >" listening on ath0, link-type PRISM_HEADER (802.11 plus Prism
> >header),
> >capture size 96 bytes"
> >
Thanks, maybe I was very tired to see DEFAULT_SNAPLEN ( here are 4:35 p.m )
and snaplen variable in pcap_open_live.
Thanks for all, now it works,
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
On Feb 21, 2006, at 6:42 PM, axi wrote:
When tcpdump receives a packet with prism headers recognized as above
:
" listening on ath0, link-type PRISM_HEADER (802.11 plus Prism
header),
capture size 96 bytes"
always prints "[|802.11]", with data, control or administration
packets. The
size
Hi to all,
this is my first message to the list, first excuse because my english and
other mistakes.
I'm developing a decoder of 802.11 packets for Snort, and the first is to
watch how that is maded in other tools,
like Kismet, Ethereal/Tethereal, and tcpdump.
Now, I'm making probes with tcpdump,
