hostap, ethereal and kismet.

[Andrea G Forte]

Sorry about that. The device in promiscuous mode was in managed mode and
connected to the same AP than the device sending the ARP requests.
So you are saying that because of some firmware bugs I will not be able
to see unicast packets
that are not for me (device in promiscuous mode). Which means that I
would not be able to see
the ARP replies to those ARP requests but I should be still able to see
the ARP requests.
Is this correct?

Thank you,
Andrea


Jouni Malinen wrote:

>On Thu, Jun 23, 2005 at 03:20:20PM -0400, Andrea G Forte wrote:
>
>  
>
>>I am trying to sniff packets on the wireless interface using ethereal 
>>and a sniffer I wrote. Now, I know that if I am not interested in 802.11 
>>frames I can use promiscuous mode only without having to worry about 
>>monitor mode. This is exactly what my sniffer and ethereal do 
>>(promiscuous mode only). However, when I try to sniff packets on wlan0 
>>with ethereal as well as my sniffer, of 10 ARP requests that another 
>>computer on my network sends, I can only see one of them and sometimes I 
>>do not see any at all. If I want to see all of them I have to use kismet 
>>which uses monitor mode. But ARP requests are not 802.11 frames, so I am 
>>a little confused.
>>    
>>
>
>You did not describe your network configuration for the device that was
>in promiscuous mode, but in theory, you should have seen ARP requests if
>they were broadcast packets and you were in managed mode and associated
>with the AP that was broadcasting the packets. However, please note that
>Host AP driver does not implement promiscuous mode because of issues
>with some firmware versions. In other words, only broadcast packets from
>the current BSS and unicast packets to the device itself would be shown
>in this kind of setup.
>
>  
>