Proprietary info sent on air?

[Jouni Malinen]

On Mon, May 26, 2003 at 12:23:02PM +0200, Francesco Sigona wrote:

> Does anyone of you know if some kind of proprietary info is sent in frames by a Prism2-based card?

Prism2 firmware seems to reply to some signal quality related data frame
(used by at least Lucent client utils). However, this is not related to
the other part of your question.

> My question arises by observation of the size of beacon frames, sent by a card in master mode. By sniffing them via ethereal on a dedicated station, I can see a size of 59 bytes. But if I check the behaviour of RxMulticastOctests and the RxMulticastFrames counters in an associated station, in a session where beacons are the olny frame sent, I can easily compute the size (RxMulticastOctests / RxMulticastFrames ) and I get always 63 bytes.

> What is this 4 bytes difference?
> They are really sent on air, or are computed locally by the receving card?

Not knowing your sniffer setup, I need to guess here.. I would assume
that you used Prism2 card in monitor mode as the sniffer. It removes FCS
(frame check sequence) from the received frames before passing them to
the host system. FCS is four octets, so it explains the difference you
see in the sizes. IEEE 802.11 uses FCS in all frames.

-- 
Jouni Malinen                                            PGP id EFC895FA