<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Ziara . wrote:
<blockquote cite="mid:BLU120-W27CC17C343647FE6B31A0D82540@phx.gbl"
type="cite">
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>Hi again, <br>
<br>
first at all, thanks for reply, continued about capturing wlan packet
with winpcap item <br>
<br>
this solution:<br>
<br>
When Winpcap captures on a wireless adapter, it sees the packets as
though they are Ethernet packets. By this I mean that the 802.11 data
header is stripped off and a fake Ethernet header is composed and
appended to the packet. This isn't Winpcap's fault, however, as this
is done before Winpcap has access to the packet. In short, if you want
to capture traffic and analyze any data beneath the MAC layer then this
solution will work for you.<br>
<br>
if I treat wlan packets like ethernet packets, when I am programming my
source code, I program like if was ethernet?<br>
<br>
pcap_datalink(adhandle) = DLT_EN10MB<br>
</blockquote>
This is correct.<br>
<blockquote cite="mid:BLU120-W27CC17C343647FE6B31A0D82540@phx.gbl"
type="cite"> <br>
and for another solution:<br>
<br>
However, if you need access to the raw 802.11 packets and all the
control and management frames, this solution will not work and an
802.11 capture card should be considered instead.<br>
<br>
It's mean that I have to get a wlan card (pcmcia, usb) that
support promiscuos mode?<br>
and use...<br>
<br>
pcap_datalink(adhandle) = DLT_IEEE802_11 ?<br>
<br>
</blockquote>
This is correct. For linux there are quite a few cards that support
promiscuous mode. This is not the case, however, for windows. Airpcap
(<a class="moz-txt-link-freetext" href="http://www.cacetech.com/products/airpcap_family.htm">http://www.cacetech.com/products/airpcap_family.htm</a>) was created to
solve this problem.<br>
<br>
Good luck with your project!<br>
<br>
<div class="moz-signature">--<br>
Dustin Johnson<br>
<b>CACE Technologies</b><br>
Tel: 530-758-2790 x109<br>
Fax: 530-758-2781<br>
<a href="http://www.cacetech.com">www.cacetech.com</a></div>
<blockquote cite="mid:BLU120-W27CC17C343647FE6B31A0D82540@phx.gbl"
type="cite"> <br>
<blockquote>
<hr>Date: Wed, 19 Dec 2007 09:47:57 -0800<br>
From: <a class="moz-txt-link-abbreviated" href="mailto:dustin.johnson@cacetech.com">dustin.johnson@cacetech.com</a><br>
To: <a class="moz-txt-link-abbreviated" href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</a><br>
Subject: Re: [Winpcap-users] Capturing wlan packets<br>
<br>
<meta content="Microsoft SafeHTML" name="Generator">
Ziara,<br>
When Winpcap captures on a wireless adapter, it sees the packets as
though they are Ethernet packets. By this I mean that the 802.11 data
header is stripped off and a fake Ethernet header is composed and
appended to the packet. This isn't Winpcap's fault, however, as this
is done before Winpcap has access to the packet. In short, if you want
to capture traffic and analyze any data beneath the MAC layer then this
solution will work for you. However, if you need access to the raw
802.11 packets and all the control and management frames, this solution
will not work and an 802.11 capture card should be considered instead.<br>
<br>
-- <br>
Dustin Johnson<br>
<b>CACE Technologies</b><br>
Tel: 530-758-2790 x109<br>
Fax: 530-758-2781<br>
<a moz-do-not-send="true" href="http://www.cacetech.com/"
target="_blank">www.cacetech.com</a><br>
<br>
Ziara . wrote:
<blockquote cite="mid:BLU120-W22349D99C74AA80C24EF3D825C0@phx.gbl">
<style>
.ExternalClass .EC_hmmessage P
{padding:0px;}
.ExternalClass EC_body.hmmessage
{font-size:10pt;font-family:Tahoma;}
</style><font face="Courier New">Hello, it's possible capturing
wlan packets with winpcap? I have research some information, and say
that:<br>
</font> <br>
<font face="Courier New, Courier, Monospace">"WinPcap is able to
see an Ethernet emulation and not the real transiting packets: this
means that the 802.11 frames are transformed into fake Ethernet frames
before being captured, and that control frames are not received" </font><br>
<br>
<font face="Courier New, Courier, Monospace">and... how I can
capturing with this method?</font><br>
<br>
<font face="Courier New">And, I find a page <a
moz-do-not-send="true"
href="http://www.micro-logix.com/WinPcap/Supported.asp" target="_blank">http://www.micro-logix.com/WinPcap/Supported.asp</a> where
list the devices wlan that work with airsnare it's means that work with
my application with winpcap too?</font><br>
<br>
<font face="Courier New">Are there some specific documentation to
capturing wlan packets with winpcap?</font><br>
<br>
<font face="Courier New">regards and thanks.</font><br>
<br>
<hr>
Sigue al minuto las principales noticias de tu ciudad <a
moz-do-not-send="true" href="http://deportes.es.msn.com/"
target="_blank">MSN Deportes</a>
<pre><hr size="4" width="90%">
_______________________________________________
Winpcap-users mailing list
<a moz-do-not-send="true" class="EC_moz-txt-link-abbreviated"
href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</a>
<a moz-do-not-send="true" class="EC_moz-txt-link-freetext"
href="https://www.winpcap.org/mailman/listinfo/winpcap-users"
target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a>
</pre>
</blockquote>
</blockquote>
</blockquote>
</body>
</html>