monitor mode APs and bpf DLTs

[Martin Husemann]

Hey folks,

I am slightly confused about the bpf details for wireless devices.

First (minor nit) there is a bogus diagnostic printed by tcpdump when
trying to use monitor mode (-I) for non-montior-mode VAPs. It
tells me about the wrong mode VAP and claims:

To create a new montior mode VAP use:
ifconfig wlan1 create wlandev run0 wlanmode monitor

... which is nearly correct, but "wlan1" should be "wlan", and unfortunately
run(4) does not support mulitple VAPs, so I need to destroy wlan0 first.
(I tested on 12.1)

But that cosmetic issue asside, I am confused whether tcpdump -I should
have any effect at all (and if not, whether it would be better to just
reject the request).

My understanding was that a VAP in monitor mode automatically (and
exclusively) will provide IEEE802_11_RADIO type frames (i.e. with
radiotap header via the iv_rawbpf tap, and plain ethernet frames via
the default tap), while a VAP in any other mode will only/exclusively
provide IEEE802_11 type frames (i.e. w/o radiotap header).

There is no difference in tcpdump -L output with or without -I, and also
no difference for "wlandmode monitor" and other mode VAPs. I expected
no difference with -I vs. no -I, but I did expect a difference between
a monitor mode VAP and a VAP in other modes.

So I guess I am missing some part of the picture - any hints?

Martin

[Martin Husemann]

Post by Martin Husemann
Hey folks,
I am slightly confused about the bpf details for wireless devices.

... and once you have seen it work, it all unriddles.

So I made two errors:

- I picked run(4) as a test example, but radiotap support (kinda obvious
once you think of it) is device dependent - and the run driver does
not support it. The device driver needs to set ic_th (the tap header
and properly initialize the length field before finalizing attachment.
- I was confused by the mumbling of tcpdump about monitor mode and
somehow assumed different/more link layer types would be available
in monitor mode (which IIUC [now] never is the case in FreeBSD) and then
totaly confused radiotap bpf access with monitor mode VAPs, but of
course they are orthogonal/independent.

Sorry for the noise.

Martin