# 802.11 link headers? **URL:** \ **Category:** Zeek\ **Created:** [August 1, 2011, 11:56pm UTC](https://community.zeek.org/t/802-11-link-headers/1954 "2011-08-01T23:56:22Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Dan\_Klinedinst](https://avatars.discourse-cdn.com/v4/letter/d/5daacb/32.png) [@Dan\_Klinedinst](https://community.zeek.org/u/Dan_Klinedinst)\ **Post date:** [August 1, 2011, 11:56pm UTC](https://community.zeek.org/t/802-11-link-headers/1954/1 "2011-08-01T23:56:22Z")
All, I dumped a bunch of packets off a wireless network to a pcap file. tcpdump says the link-type is IEEE802\_11\_RADIO. If I try to run Bro against the file, I get "unknown data link type 0x7f". I assume this means Bro doesn't understand the link layer data, since it's not Ethernet. [Error is from PktSrc.cc PktSrc::SetHdrSize()] So, is there a way to tell Bro to just ignore the link layer? Or would it then not know where the layer 3 data starts? And if there is not, anyone know a tool that will strip the 802.11 headers and replace them with fake Ethernet headers so I can use Bro on the traffic?? Thanks Dan ---
**Author:** ![Gregor\_Maier](https://avatars.discourse-cdn.com/v4/letter/g/94ad74/32.png) [@Gregor\_Maier](https://community.zeek.org/u/Gregor_Maier)\ **Post date:** [August 2, 2011, 12:40am UTC](https://community.zeek.org/t/802-11-link-headers/1954/2 "2011-08-02T00:40:26Z")
Hi, the IEEE802\_11\_RADIO linktype adds a bunch of information from the radio before the actual ethernet header and it appears that this info is variable length. The problem is that Bro doesn't have support for this linktype and so Bro doesn't know where the IP header starts. Since this linktype adds a variable length header it's not straight forward to add support for it (although it's probably not too hard either). (For fixed length headers one would just add an appropriate case to get\_link\_header\_size() in PktSrc.cc) I've added a feature request to Bro's tracker for that though. If you can capture new traces and depending on your OS and tcpdump version, so can run tcpdump \*without\* the "-I" option or with a "-y EN10MB" option. The tcpdump records plain old ethernet only headers that Bro can deal with. Unfortunately, I don't know of a tool that can convert from IEEE802\_11\_RADIO to EN10MB ☹ cu Gregor ---
**Author:** ![Dan\_Klinedinst](https://avatars.discourse-cdn.com/v4/letter/d/5daacb/32.png) [@Dan\_Klinedinst](https://community.zeek.org/u/Dan_Klinedinst)\ **Post date:** [August 2, 2011, 5:01am UTC](https://community.zeek.org/t/802-11-link-headers/1954/3 "2011-08-02T05:01:03Z")
All, It turns out that if you force tcpdump to output IEEE802\_11 (without the \_RADIO), you get a standard, fixed-length 802.11 header of 32 bytes. I added an entry for that in get\_link\_header\_size() in PktSrc.cc and now Bro works like a charm on live WiFi traffic. I'll submit a patch tomorrow. Dan ---
**Author:** ![Gregor\_Maier](https://avatars.discourse-cdn.com/v4/letter/g/94ad74/32.png) [@Gregor\_Maier](https://community.zeek.org/u/Gregor_Maier)\ **Post date:** [August 2, 2011, 5:11pm UTC](https://community.zeek.org/t/802-11-link-headers/1954/4 "2011-08-02T17:11:00Z")
Cool! Note however that libpcap's filter code generation treats both IEEE802\_11 and IEEE802\_11\_RADIO as having a variable length header. It might well be that the variable part only varies between drivers, so it might be a constant 32 bytes with your NIC but not necessarily with others. (I might be wrong though. I didn't find a specification for these DLT's just guessing from glancing at libpcap) cu gregor ---
**Author:** ![Dan\_Klinedinst](https://avatars.discourse-cdn.com/v4/letter/d/5daacb/32.png) [@Dan\_Klinedinst](https://community.zeek.org/u/Dan_Klinedinst)\ **Post date:** [August 2, 2011, 6:00pm UTC](https://community.zeek.org/t/802-11-link-headers/1954/5 "2011-08-02T18:00:09Z")
Gregor, Thanks for reminding me - I forgot that the header size will, at a minimum, change if you use WEP/WPA\*. I'll take a look at this some more and see if I can write a patch to cover all the cases (at least without the radio headers). Dan ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:39pm UTC](https://community.zeek.org/t/802-11-link-headers/1954/6 "2022-05-06T15:39:42Z")
Closed on May 6, 2022, 3:39pm UTC