Ethereal-users: Re: [Ethereal-users] ethereal and 802.11

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Thu, 29 Nov 2001 14:31:35 -0800 (PST)
> It's not capturing any of the RAW 802.11 frames as i had wanted it to.
>  
> After the successful compilation.I checked the Ethereal "Help" button to
> ensure that its really 0.8.20 and LibpcapCVS, I ran the following
> command - 'echo "Mode: rfmon" >>/proc/driver/aironet/eth0/Config' AND
> 'ifconfig eth0 up'.
>  
> I then went to this place with lots of Beacon Signals (I checked with
> airopeek's demo.got lots of signals), but ethereal dun seem to be
> catching anything.Even running tcpdump is quiet.

That's tcpdump from CVS (or 3.7 beta), I assume.

If so, that indicates that this isn't an Ethereal issue (which is not
surprising - Ethereal just gets what libpcap gives it); as you're using
libpcap from CVS, it's probably not a libpcap issue (also not surprising
- libpcap just gets what the kernel gives it), so, given that, as per
your earlier mail, you do, in fact, have an Aironet card (so that the
"Mode: rfmon" stuff is what the driver *should* support), it's probably
a driver issue.

Do you have a 2.4.6 or later kernel?

If so, then you should probably report this to Red Hat (or check out the
Linux 802.11 Aironet driver pages at

	http://sourceforge.net/projects/airo-linux/

and

	http://airo-linux.sourceforge.net/

to see if they have any information about this).  It might be that the
card in question doesn't support monitor mode, or something.

If not, upgrade - Javier Achirica indicated to me that you need the
2.4.6 or later kernel's Aironet driver.