Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 17:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Initial commit of RadioTap encapsulation support)

Browse source 
- It works for me, but I believe that one of the headers I'm stripping
   is variable length so this is unlikely to be complete.
This commit is contained in:
Seth Hall 2015-02-04 23:33:20 -05:00
parent 4d0a09a037
commit 9a71f8aa86
1 changed files with 23 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

23
src/iosource/PktSrc.cc
View file

@ -171,6 +171,9 @@ int PktSrc::GetLinkHeaderSize(int link_type)
case DLT_PPP_SERIAL: // PPP_SERIAL
return 4;
case DLT_IEEE802_11_RADIO: // 802.11 plus RadioTap
return 59;
case DLT_RAW:
return 0;
}
@ -376,6 +379,26 @@ void PktSrc::Process()
}
break;
}
case DLT_IEEE802_11_RADIO:
{
protocol = (data[57] << 8) + data[58];
if ( (data[54] == 0 && data[55] == 0 && data[56] == 0) &&
(protocol == 0x0800 || protocol == 0x86DD) )
{
// Found an IPv4 or IPv6 packet.
// Skip over the RadioTap header, the IEEE QoS header,
// and logical link control header.
data += GetLinkHeaderSize(props.link_type);
pkt_hdr_size = 0;
}
else
{
Weird("non_ip_packet_in_ieee802_11_radio_encapsulation", &current_packet);
goto done;
}
break;
}
}
if ( have_mpls )