Wireshark · Ethereal-users: Re: [Ethereal-users] raw IEEE 802.11 headers

[Guy Harris <gharris@xxxxxxxxx>]

Luis Del Pino wrote:
> Hello¡¡¡ My question is, Can you capture raw 802.11 headers in 
> promiscuous mode or only in monitor mode?

It depends on the OS you're using.

For some 802.11 adapters, recent versions of 
{Free,Net,Open,DragonFly}BSD should let you capture them in 
non-promiscuous mode, promiscuous mode, or monitor mode; you have to set 
the "Link-layer header type", using "Capture->Options".

Linux systems tend to support them only in monitor mode, and Windows 
doesn't support them at all on WinPcap-based applications such as Ethereal.

> I have to capture information of radio such signal strength, noise 
> strength etc.

That's not just raw 802.11 headers, that's "radio headers".  The BSDs 
mentioned above support them in all capture modes, but only on some 
adapters - and the set of adapters might be smaller than the set of 
adapters that support raw 802.11 headers.  I don't know what Linux 
systems do - there might be a way (with a command) to select whether to 
get radio headers or not, but they're probably also monitor mode only. 
You don't get them on Windows with WinPcap-based applications.