On Mon, May 13, 2002 at 01:32:19AM -0700, Guy Harris <[EMAIL PROTECTED]> wrote:
> > This is because it expects (at least in beacon frames) that tagged
> > elements have a stop marker (0xff), which the standard doesn't talk about
>
> ...and therefore I removed the check for the stop marker.
One thing I found yesterday while browsing the web: prismdump (a utility
that switches prism wavelan cards in rfmon mode and creates a pcap dump
file) seems to be the reason for this behaviour, as prismdump seems to
create dump files with an additional 0xffffffff at the end of each packet.
So this behaviour might be useful.
Another thing I oticed is that while this bug was in effect (can't test
right now), -xX didn't output anything on these "corrupt" packets, which
made it particularly difficult to track down the bug (couldn't see which
kind of packet actually was causing this).
> I also changed it to use "fn_print()" to print SSIDs, and fixed some
> other things I ran across while looking at the output of tcpdump on some
Sounds great ;->
--
-----==- |
----==-- _ |
---==---(_)__ __ ____ __ Marc Lehmann +--
--==---/ / _ \/ // /\ \/ / [EMAIL PROTECTED] |e|
-=====/_/_//_/\_,_/ /_/\_\ XX11-RIPE --+
The choice of a GNU generation |
|
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
