axi wrote: > My driver/card in monitor mode sends to libpcap a frame with FCS, > when tcpdumps ( version 3.9.4 ) parsers i.e a valid Beacon Frame, it's > identifies FCS part as a Tagged Parameter in a Management Body, and > sometimes when pass TEST2 check, caused by that prints [|802.11] instead > of Beacon. > ¿ Is there anyway to automatically detect FCS in 802.11 frames ? ¿
Unfortunately, not in general. The radiotap header does include a flag that indicates that the frame includes an FCS, so *if* the driver you're using supplies a radiotap header *and*, if it includes the FCS in the packet data, includes the "FCS present" flag, tcpdump could (and should) be modified to treat the last 4 bytes of the frame (if the frame is full-length, i.e. if you don't use the default snapshot length) as an FCS. On the BSDs, most drivers use radiotap headers; I don't know whether any of the BSD drivers include the FCS in the packet data or, if they do, whether they set the appropriate flag in the radiotap header. I think most Linux drivers don't use radiotap headers. On what operating system are you running tcpdump? - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
