From: Glenn Judd (glennj+_at_cs.cmu.edu)
Date: 2002-08-08 17:26:44 UTC
I'm attempting to use monitor mode for a conceptually simple task: listen to _all_ 802.11 frames. I believe I have the driver working "correctly"; unfortunately, the current implementation of monitor mode seems to be unable to listen to all frames. There are several problems:
(A simple experiment in which I see this is with three computers in 802.11 ad-hoc mode. Computer 1 pings computer 2 while computer 3 is in monitor mode. Computer 3 sees the acks from the data packets in addition to beacon frames, arps, etc., but the data frames are completely bogus. I should mention that all three computers are practically touching and the noise is quite low so there should be no _real_ FCS errors.)
So, I'm wondering if, in monitor mode, anyone has been able to listen to unicast data frames where the source & dest were not the monitoring host? I can do this with say tcpdump in regular promiscuous mode, but I need the 802.11 layer information.
I'm using the CVS version from July 30th. I don't think the version is an issue since the problem seems quite fundamental. My card is a DLink DWL-650, and my test network is not using WEP.
(Also, if anyone happen to know of any other card/driver/os/application combination that can give me _all_ 802.11 frames I'd be interested.)