Re: [Query] Decryption and Monitor Mode
Krishna Chaitanya <[email protected]> Wed, 6 Nov 2013 15:45:50 +0530
| Newsgroups | org.netbsd.radiotap,org.kernel.vger.linux-wireless |
|---|---|
| Message-ID | <CABPxzYLYZ=M=a7of-0HyNnJb_g9jP2wNXp378RN5ai-BjngQOw@mail.gmail.com> |
On Wed, Nov 6, 2013 at 1:29 PM, Johannes Berg <[email protected]> wrote: > On Wed, 2013-11-06 at 01:22 +0530, Krishna Chaitanya wrote: > >> With this wireshark is not able to decode the packets, even thought >> they are decrypted. I propose 2 solutions > > Well, you can say "ignore protected bit (with IV)" in the settings of > wireshark. But I agree that this is cumbersome, and previously floated > the idea of addings bits to radiotap to make this auto-detected. > yeah, that piece of code looks messy. >> Radiotap and Wireshark: >> >> 1) Add 2 flags to the radiotap RX Flags (HW Decrypted the packet, >> Packet has security Header (for some chipsets which consume the >> security header as well..??).) >> >> Based on these the wireshark dissector decodes the packet accordingly. >> >> mac80211: >> >> 2) Remove the security header information in the monitor path as well >> based on the existing RX_FLAGS. >> >> >> Solutions 2 looks more elegant and simple, any comments? > > Solution 2 drops information and makes the kernel code more expensive, > so I don't think we want that. > > I think the radiotap bits would be better. > Ok, then i will proceed and add those 2 flags to the RX Flags (we have enough bits to use).