Hello,
the following bpf filters with ethernet addresses like 'ether host <macaddr>' or synonym: 'wlan host <macaddr>' and others with mac address checks like gateway, multicast, ... are not handled within gencode.c if you monitor a WLAN device in monitor mode with PRISM header prependend.
There are missing CASE statements for DLT_PRISM_HEADER in the different filter checks and a modified gen_wlanhostop to shift the packet the prism header length, but using the same logic as for the DLT_IEEE802_11 link layer.
The same is true for the other driver specific prepended 802.11 headers like DLT_IEEE802_11_RADIO and DLT_IEEE802_11_RADIO_AVS.
It would be nice if someone could spend some time to fix this.
Sorry, I don't oversee side effects in the distribuiton to patch it myself.
Best Regards and many thanks in advance Charly -- Please support the software patent adversaries: http://www.nosoftwarepatents.com/ KIZ/Infrastructure, University of Ulm, Germany - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.