Capturing 802.11 frames in managed mode

[Jouni Malinen]

On Wed, Mar 02, 2005 at 02:01:26PM +0100, Ajeet Nankani wrote:

> Is it possible to capture 802.11 frames when the card is in managed 
> mode? Because i want to capture every packet of the whole process from 
> attaching of STA with first AP and then roaming to 2nd AP and 3rd AP... 
> Nth AP.

Some of the packets, yes; all of them, no..

> In ethereal if the card is in managed mode, it only allows to capture 
> Ethernet frames, and only if the card is in monitor mode then it allows 
> you to capture 802.11 frames. So this means usually one needs 11 or 13 
> cards in monitor mode one on each channel to capture with 100 percent 
> accuracy without missing a single frame.

I would not expect to get 100% accuracy when capturing frames from
wireless media, no matter how many sniffers you add..

Anyway, Host AP driver is receiving the frames with IEEE 802.11 headers,
but not FCS, so this would not be full frame. However, the firmware does
not deliver all received packets to the driver. In case of managed mode,
most (or likely all) control frames are filtered out and so are many of
the management frames.

> So I am wondering is there any option, through which i get 802.11 frames 
> in ethereal when the card is in manged mode?

You could get data packets with IEEE 802.11 headers a small driver
changes and even some of the management frames, but you would not get
all IEEE 802.11 frames with Prism2/2.5/3 cards.

-- 
Jouni Malinen                                            PGP id EFC895FA