[Winpcap-users] how Wireshark get linktype?

[Guy Harris]

On Sep 1, 2009, at 5:31 PM, Joshua (Shiwei) Zhao wrote:

> 2) Since I already set the driver to monitor mode, I thought winpcap
> should return that as the default.
>    In fact, winpcap doesn't even return DLT_IEEE802_11_RADIO as an
> option. It only gives the default linke types. That's why I wonder
> whether there is compatibility issue between winpcap and the driver
> and whether winpcap uses those two OIDs for linktype queries.

WinPcap knows nothing about monitor mode; it's a NDIS 5.x driver, and  
there's no notion of "monitor mode" in NDIS 5.x.  It also has no  
notion of DLT_IEEE802_11_RADIO or even DLT_IEEE802_11, as there's no  
notion of a device returning 802.11 headers in NDIS 5.x.