Re: [Madwifi-users] What can I get in monitor mode?

[Rob M. <rma...@ri...>]

I highly recommend WireShark. 

It will give you a really good visual of the packets and their contents.
Wireshark also has provisions for decryting WEP/WPA, statistics, HTTP
decoding, and MUCH more.  TCPdump is commandline and not as nice for
learning.

Also, when in monitor mode with madwifi, you have the option of
attaching monitoring frames, in RadioTap and PRISM.  Radiotap is the
default, and is much easier to work with (it's well documented and is
standardized)  Check the wiki on how to change/disable these headers if
need be.  It is important to remember that these frames are not actually
part of the transmitted data over the wireless card, but they are
counted in the byte size in tcpdump/Wireshark/any libpcap sniffer.



Rob MacKenzie 
Advanced Connectivity Developer

-----Original Message-----
From: mad...@li...
[mailto:mad...@li...] On Behalf Of Koos
van den Hout
Sent: May 26, 2008 4:12 AM
To: mad...@li...
Subject: Re: [Madwifi-users] What can I get in monitor mode?

Quoting ?????? who wrote on Mon 2008-05-26 at 10:58:

> I found that a wireless card can work under "monitor" mode, then"This
device
> can be used to "sniff" raw 802.11 frames".
> 
> But after setting it to monitor mode, I do not know how to get the
collected
> statistics. Or does it need to install some sniffer tools to do the
> measurement?

Yes. This can be as basic as tcpdump or special software like kismet
(wardriving software which will combine found networks and gps locations
to
map the networks).

Setting it to monitor mode just makes the raw 'radio' frames available
to
applications. It is up to applications to do something with them.

> Basically I want to keep a record about "at which timestamps a
wireless card
> sends a frame", your suggestions and comments are warmly welcomed.

In that case tcpdump should be enough.

                                               Koos van den Hout

-- 
Koos van den Hout,           PGP keyid DSS/1024 0xF0D7C263 via
keyservers
ko...@kz...        or RSA/1024 0xCA845CB5
Fax +31-30-2817051             Snowcam: webcams for your wintersport
holiday
http://idefix.net/~koos/                         http://www.snowcam.org/

------------------------------------------------------------------------
-
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Madwifi-users mailing list
Mad...@li...
https://lists.sourceforge.net/lists/listinfo/madwifi-users

---------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.