[Bro-Dev] #529: Support for DLT IEEE802_11_RADIO linktype

[Bro Tracker]

#529: Support for DLT IEEE802_11_RADIO linktype
-----------------------------+------------------------
 Reporter:  gregor           |      Owner:
     Type:  Feature Request  |     Status:  new
 Priority:  Low              |  Milestone:
Component:  Bro              |    Version:  git/master
 Keywords:                   |
-----------------------------+------------------------
 {{{
 #!rst

 Add support for DLT IEEE802_11_RADIO to Bro. It appears this linktype adds
 a bunch of info from the WLAN radio in front of the actual ethernet
 header. Unfortunately, it appears to have variable length headers, to
 adding support to Bro is not trivial.

 Many (all?) wlan interface can create pcap captures with this DLT. E.g,
 one can use

 * ``tcpdump -I ....``  or
 * ``tcpdump -y IEEE802_11_RADIO``  (depending on OS and tcpdump version
 used)

 On my Mac OS ``tcpdump -I`` works.
 }}}

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/529>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker