hostap, ethereal and kismet.

[Jouni Malinen]

On Thu, Jun 23, 2005 at 03:20:20PM -0400, Andrea G Forte wrote:

> I am trying to sniff packets on the wireless interface using ethereal 
> and a sniffer I wrote. Now, I know that if I am not interested in 802.11 
> frames I can use promiscuous mode only without having to worry about 
> monitor mode. This is exactly what my sniffer and ethereal do 
> (promiscuous mode only). However, when I try to sniff packets on wlan0 
> with ethereal as well as my sniffer, of 10 ARP requests that another 
> computer on my network sends, I can only see one of them and sometimes I 
> do not see any at all. If I want to see all of them I have to use kismet 
> which uses monitor mode. But ARP requests are not 802.11 frames, so I am 
> a little confused.

You did not describe your network configuration for the device that was
in promiscuous mode, but in theory, you should have seen ARP requests if
they were broadcast packets and you were in managed mode and associated
with the AP that was broadcasting the packets. However, please note that
Host AP driver does not implement promiscuous mode because of issues
with some firmware versions. In other words, only broadcast packets from
the current BSS and unicast packets to the device itself would be shown
in this kind of setup.

-- 
Jouni Malinen                                            PGP id EFC895FA