[Bro-Dev] #529: Support for DLT IEEE802_11_RADIO linktype

Bro Tracker bro at tracker.bro-ids.org
Mon Aug 1 17:46:43 PDT 2011

#529: Support for DLT IEEE802_11_RADIO linktype
 Reporter:  gregor           |      Owner:
     Type:  Feature Request  |     Status:  new
 Priority:  Low              |  Milestone:
Component:  Bro              |    Version:  git/master
 Keywords:                   |

 Add support for DLT IEEE802_11_RADIO to Bro. It appears this linktype adds
 a bunch of info from the WLAN radio in front of the actual ethernet
 header. Unfortunately, it appears to have variable length headers, to
 adding support to Bro is not trivial.

 Many (all?) wlan interface can create pcap captures with this DLT. E.g,
 one can use

 * ``tcpdump -I ....``  or
 * ``tcpdump -y IEEE802_11_RADIO``  (depending on OS and tcpdump version

 On my Mac OS ``tcpdump -I`` works.

Ticket URL: <http://tracker.bro-ids.org/bro/ticket/529>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker

More information about the bro-dev mailing list