如何使用wireshark抓到报文radiotap的信息

 

本人希望在不修改内核的情况下获得每个数据报文的RSS的大小，查阅资料后得知可以使用wireshark抓取报文，在报文的radiotap头中会有rssi的信息。但是实际操作后发现获取的报文是这个样子的：

查阅资料后发现，当无线网卡不支持或者没有设置为monitor mode时，无线网卡的驱动会自动把802.11 frame 转化为Ethernet frame后给kernel。官方解释为：

If you‘re trying to capture network traffic that‘s not being sent to or from 
the machine running Wireshark or TShark, i.e. traffic between two or more 
other machines on an Ethernet segment, or are interested in 802.11 management 
or control packets, or are interested in radio-layer information about 
packets, you will probably have to capture in "monitor mode". This is 
discussed below.

Without any interaction, capturing on WLAN‘s may capture only user data 
packets with "fake" Ethernet headers. In this case, you won‘t see any 802.11 
management or control packets at all, and the 802.11 packet headers 
are"translated" by the network driver to "fake" Ethernet packet headers.

使用iwconfig命令后发现：

此时无线网卡的模式为managed。因此，我试着去打开无线网卡的monitor mode。查阅资料后，使用命令：

 

sudo ifconfig wlan11 down
sudo iwconfig wlan11 mode monitor
sudo ifconfig wlan11 up

再次运行iwconfig后发现：

此时，网卡的模式已经变为Monitor，在使用wireshark进行抓包，发现也有了radiotap header：

 

转载于:https://www.cnblogs.com/qwblog/p/8744882.html