Re: Question on IEEE802_11_RADIO

2004-02-28 Thread Richard Bejtlich
--- Bruce M Simpson <[EMAIL PROTECTED]> wrote: > Don't use monitor mode; it's a misnomer. Try without > using monitor > mode and you should see radiotap headers. > > BMS Hi Bruce, Without monitor mode I get worse results for IEEE802_11, but IEEE802_11_RADIO gives the same results. orr:/root#

Re: Question on IEEE802_11_RADIO

2004-02-27 Thread Bruce M Simpson
On Fri, Feb 27, 2004 at 02:27:57PM -0800, Richard Bejtlich wrote: > >From what I've read elsewhere on the lists, I'm not > seeing what I should using the new IEEE802_11_RADIO > link type. Tcpdump is compiled --WITH_RADIOTAP: Don't use monitor mode; it's a misnomer. Try without using monitor mode

Question on IEEE802_11_RADIO

2004-02-27 Thread Richard Bejtlich
Hello, >From what I've read elsewhere on the lists, I'm not seeing what I should using the new IEEE802_11_RADIO link type. Tcpdump is compiled --WITH_RADIOTAP: -- orr:/root# uname -a FreeBSD orr.taosecurity.com 5.2-SECURITY FreeBSD 5.2-SECURITY #0: Thu Feb 5 10:24:52 GMT 2004 [EMAIL PROTECT