Re: [tcpdump-workers] Missing packet fields in big endian with ath9k

2013-04-27 Thread Denis Ovsienko
> Im getting DLT_IEEE802_11_RADIO. Is this ok? Hello. This issue with DLT_IEEE802_11_RADIO and the frame being offset by 4 octets may have something in common with another issue: https://github.com/the-tcpdump-group/tcpdump/issues/303 There are patches attached there that may come handy. --

Re: [tcpdump-workers] Missing packet fields in big endian with ath9k

2013-04-27 Thread Guy Harris
On Apr 27, 2013, at 3:26 PM, Luis Correia wrote: > Im getting DLT_IEEE802_11_RADIO. Is this ok? Yes. That means you have a Radiotap header. > About the rssi values I managed to get them by teaching myself little endian > vs big endian and redefining my struct's fields. > > I'm now getting

Re: [tcpdump-workers] Missing packet fields in big endian with ath9k

2013-04-27 Thread Luis Correia
Hi Harris, thnks for your help. On Apr 27, 2013, at 2:03 AM, Guy Harris wrote: > > On Apr 26, 2013, at 11:50 AM, Luis Correia wrote: > >> I check for link type this way: >> (pcap_datalink(dev_handler) ==DLT_IEEE802_11) , >> So i'm pretty sure its the right data link. > > DLT_IEEE802_11 is