Monitor mode broken?

From: Glenn Judd (
Date: 2002-08-08 17:26:44 UTC

Hi All,

I'm attempting to use monitor mode for a conceptually simple task: listen to _all_ 802.11 frames. I believe I have the driver working "correctly"; unfortunately, the current implementation of monitor mode seems to be unable to listen to all frames. There are several problems:

   (A simple experiment in which I see this is with three    computers in 802.11 ad-hoc mode. Computer 1 pings    computer 2 while computer 3 is in monitor mode. Computer    3 sees the acks from the data packets in addition to    beacon frames, arps, etc., but the data frames are    completely bogus. I should mention that all three    computers are practically touching and the noise is    quite low so there should be no _real_ FCS errors.)

So, I'm wondering if, in monitor mode, anyone has been able to listen to unicast data frames where the source & dest were not the monitoring host? I can do this with say tcpdump in regular promiscuous mode, but I need the 802.11 layer information.

I'm using the CVS version from July 30th. I don't think the version is an issue since the problem seems quite fundamental. My card is a DLink DWL-650, and my test network is not using WEP.

(Also, if anyone happen to know of any other card/driver/os/application combination that can give me _all_ 802.11 frames I'd be interested.)


Glenn Judd

This archive was generated by hypermail 2.1.4.