On Mon, Mar 08, 2004 at 08:16:48PM +0100, Michael Fischer wrote:
> I have a question about a remote capture.
> This mean I have build a black box which is able to capture WIFI frames.
> This captured frames is send over ethernet on the lan.
>
> Now I will analyse this frames with Ethereal. I see the frames in
> Ethereal but Ethereal will not decode it as IEEE802.11.
How is your black box sending the frames over Ethernet? If it's just
repeating the raw frame data, putting them inside low-level Ethernet
framing, and Ethereal's capturing the frames on the Ethernet on which
the frames are being sent, then Ethereal will dissect them as Ethernet
frames, not 802.11 frames - and it *should* dissect them as Ethernet
frames, as it has no way of knowing that they're not Ethernet frames.
If that's what you're doing, I think that 802.11 frames can be larger
than the largest Ethernet frame, so it's not clear that just
retransmitting the raw 802.11 header and data as an Ethernet frame will
work in all cases. You might, instead, want to have the black box
encapsulate the frames inside, for example, a UDP packet, or a packet on
a TCP connection, and have a program that reads those packets and writes
them to a file in the standard libpcap format that Ethereal uses, with
the standard 802.11 link-layer type value of 105 in the file header.
