Hello,
the following bpf filters with ethernet addresses like
'ether host <macaddr>' or synonym: 'wlan host <macaddr>'
and others with mac address checks like gateway, multicast, ...
are not handled within gencode.c if you monitor a WLAN device in
monitor mode with PRISM header prependend.
There are missing CASE statements for DLT_PRISM_HEADER in
the different filter checks and a modified gen_wlanhostop
to shift the packet the prism header length, but using the
same logic as for the DLT_IEEE802_11 link layer.
The same is true for the other driver specific prepended 802.11
headers like DLT_IEEE802_11_RADIO and DLT_IEEE802_11_RADIO_AVS.
It would be nice if someone could spend some time to fix this.
Sorry, I don't oversee side effects in the distribuiton to patch
it myself.
Best Regards and many thanks in advance
Charly
--
Please support the software patent adversaries:
http://www.nosoftwarepatents.com/
KIZ/Infrastructure, University of Ulm, Germany
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
