Karl Gaissmaier wrote:
There are missing CASE statements for DLT_PRISM_HEADER in the different filter checks and a modified gen_wlanhostop to shift the packet the prism header length, but using the same logic as for the DLT_IEEE802_11 link layer.
It requires more than that.
ARPHRD_PRISM is used in Linux both for the Prism and the AVS radio headers, so which header a packet has can be determined only by the generated BPF program checking the header.
The Prism header and the current AVS header have different lengths; this means that the link-layer header for DLT_PRISM_HEADER is variable-length, and libpcap currently can't generate code for variable-length link-layer headers.
The same is true for the other driver specific prepended 802.11 headers like DLT_IEEE802_11_RADIO
The radiotap header is also variable length, so the same problem exists.
and DLT_IEEE802_11_RADIO_AVS.
Currently, that's not used, because there's no ARPHRD_ value in Linux for the AVS header (unless it was recently introduced).
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
