Subject: Re: NetBSD 2.0 + Atheros monitor mode + tcpdump = no 802.11 ACKs?
To: None <tech-net@NetBSD.org>
From: David Young <dyoung@pobox.com>
List: tech-net
Date: 11/10/2004 10:24:27
On Wed, Nov 10, 2004 at 09:30:56AM -0500, David Hudak wrote:
> Hi,
>
> Question for the group: I am using NetBSD 2.0 with an Atheros 5212
> radio. I put the radio in monitor mode and do tcpdump -D IEEE802_11...
> I have seen the following...
> 1. beacons
> 2. probe requests, probe responses
> 3. auth requests, auth responses
> 4. association requests, association responses
> 5. data frames
>
> But, I have not seen any 802.11 ACKs. Is this expected behavior? I
> know that they are there, since a sniff with KisMAC using an original
> Apple Airport (i.e., Orinoco) card shows them.
That's a bug. There are a few problems, beginning with this check
in ath_rx_proc,
len = ds->ds_rxstat.rs_datalen;
if (len < IEEE80211_MIN_LEN) {
DPRINTF(ATH_DEBUG_RECV, ("%s: short packet %d\n",
__func__, len));
sc->sc_stats.ast_rx_tooshort++;
goto rx_next;
}
It looks to me like that check can be postponed until a few lines later
when the WEP header is stripped. These days, it's ok to pass a short
frame to net80211, which taps the IEEE802_11 DLT.
(Now that I am looking at ath_rx_proc, I'd sure like to revamp its
radiotap section.)
Dave
--
David Young OJC Technologies
dyoung@ojctech.com Urbana, IL * (217) 278-3933