How to get IEEE 802.11 management frames in orinoco_cs

Jussi Vestman vestman at
Thu Aug 2 20:08:49 EST 2001

On Tue, 24 Jul 2001, Jussi Vestman wrote:

> On Tue, 24 Jul 2001, David Gibson wrote:
> > > Then I began wonder what for HERMES_RXSTAT_WMP definition
> > > existed. I added check for it to __dldwd_ev_rx() -function.
> > > It receives management frames with frame_ctl 0x0208 from
> > > all access points few times a minute. This rate is not high
> > > enough for my needs, so I am currently trying to send probe
> > > requests. I have written ioctl call to that purpose and it
> > > appears to write packet successfully to bap and also send
> > > it. But __dldwd_ev_txexc() -function prints an error
> > > message.
> >
> > That's even more interesting.  I would be very interested to get a
> > copy of the code you're using for this, even if it is incomplete and
> > experimental.
> I made my conclusions too early. Every received frame does
> seem to have HERMES_RXSTAT_WMP -bit set. I noticed these
> "management" packets received via __dldwd_ev_rx were
> actually ARP requests..
> So, only real management frames I have reveiced were
> genarated by violently removing and inserting access points'
> interface cards. I am wondering if card does not pass all
> management frames to driver layer.

Well. I set card to promiscuous mode with ifconfig. Guess
what? __dldwd_ev_info() is now called about every tenth
second in promiscuous mode. This seems to happen even if
there exists no network. Only problem is that I don't manage
to read packet with hermes_bap_pread without errors, so the
header I get, is probably bogus. hermes_bap_pread() returns
value -5, which meaning is "Success" according to perror()!

Mr. Jussi Vestman
An IT student at Lappeenranta University of Technology, Finland
jussi.vestman at

More information about the wireless mailing list