On Apr 19, 2016, at 7:07 AM, Yang Luo <[email protected]> wrote:
> I want to know does this 3) option make any sense to anyone? How does Linux
> handle this? I want to keep the same behavior with Linux.
What Linux does for mac80211 drivers (which I think the majority of drivers
are) is
1) fake Ethernet packets when not in monitor mode
2) 802.11 packets with radiotap headers in monitor mode.
OS X is similar, although the drivers may offer choices other than radiotap for
radio metadata headers in monitor mode (and offer "raw IP" in both modes, just
for the lulz).
At least at one point at least some *BSDs could provide 802.11 packets when not
in monitor mode, but the way FreeBSD, at least, handles monitor mode changed at
some point, and I haven't had time to look at it yet - they may only offer
802.11 packets in monitor mode now.
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <[email protected]>
Archives: https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:[email protected]?subject=unsubscribe
