Radiotap proto not supported?

[k0a1a]

Trying to setup pcap_file output using radiotap protocol and getting this:

pom> output start pcap_output
Error while setting output 'pcap_output' parameter 'running' to 'yes'
pom> Protocol radiotap is not supported
pom> output show
pcap_output: running: no, type: pcap_file | bytes_out: 3368.2K, pkts_out: 17200
filename : 'out.pcap' (string)
filter : '' (string)
protocol : 'radiotap' (string)
snaplen : '1550' (uint16)
unbuffered : 'no' (bool)

(there is some data on the pcap_output because before i used 80211 protocol)

Is radiotap protocol supported? I see that pom-ng sources contain radiotap related files..

thanks,
d

[gmsoft-tuxicoman]

Output pcap was definitely not in sync with the implemented ones.
I've added it a few others. Let me know if that works. The changes are pushed to master.

[k0a1a]

Cheers, works!
I suppose it would also be possible to come up with a new 'protocol' (filter?) definition that would allow to decap wireless frames and convert to ethernet?

[gmsoft-tuxicoman]

Glad it works :)

Regarding changing packets to ethernet, it's not the purpose of pom-ng. However it can save radiotap packets starting at another layer such as 80211 or ipv4.

[k0a1a]

Yes, I'm looking at the code of ./src/modules/proto/proto_ethernet.c and ./src/modules/proto/proto_radiotap.c and trying to understand how would I go about using a frame sans radiotap header and assuming the rest is ethernet frame treat it as such..
or is there a simpler way of doing it using existing methods?

d

[gmsoft-tuxicoman]

Sorry I don't think I understand what you mean.
If you have a frame which is : radiotap | 80211 | ipv4 | etc, you simply set protocol to either of those and output_pcap will do the trimming when saving.

Btw, the current proto_radiotap implementation assumes that the following layer is 802.11.

If you want to discuss pom-ng development, I suggest you join #pom-ng on irc.freenode.net.

Regards,
Guy