kohler / click

The Click modular router: fast modular packet processing and analysis
Other
740 stars 321 forks source link

Seeing dummy packets on Wireshark #398

Open avishekfsu opened 6 years ago

avishekfsu commented 6 years ago

Hello

I am trying to learn click and came across a weird issue, if any one can offer some assistance on this, it would be really helpful

I am running click on 2 laptops set in monitor mode with packet injection, and trying to broadcast packets from one machines (sender). I tried to run the example code posted on the WifiEncap page

https://github.com/kohler/click/wiki/WifiEncap

// this configuration sends 1000 broadcast packets at 1 megabit // to device ath0 with ethertype 0x9000

inf_src :: InfiniteSource(DATA , LIMIT 1000, ACTIVE true) -> EtherEncap(0x9000, ath0, ff:ff:ff:ff:ff:ff) -> wifi_encap :: WifiEncap(0x00, 0:0:0:0:0:0) -> set_rate :: SetTXRate(RATE 2) -> ExtraEncap() -> to_dev :: ToDevice (ath0);

However this code did not run as is. I can see the packets reaching the sender's wireshark interface, but they are never really sent out after that, I don't see any packets on the receiver's wireshark.

As a quick fix, I tried adding in a radiotap header to make the code look something like this inf_src :: InfiniteSource(DATA , LIMIT 1000, ACTIVE true) -> EtherEncap(0x8000, mon0, ff:ff:ff:ff:ff:ff) -> wifi_encap :: WifiEncap(0x00, 0:0:0:0:0:0) -> set_rate :: SetTXRate(RATE 2) -> RadioTapEncap() -> to_dev :: ToDevice (mon0);

Now I can see the packets being received correctly on the receiver's wireshark. However the sender's wireshark records double the amount of packets on it's outgoing interface, (2000 in this case) and half of these packets are basically "dummy" packets that are never really sent out but dropped form the interface).

I checked the difference between the 2 packets reaching the sender's wireshark, and the only difference is the radiotap header length is 14 bytes for an actual packet and 13 bytes for a dummy packet. Digging in further I see that the dBm Tx power flag is set for an actual packet while it is false for the dummy packet.

If someone can help me out on this , it would be really great. I checked the past issues on this page and it seems like the the radiotapencap function has been modified a number of times. Is it possible that there is still an existing issue ? Or am I doing something completely wrong ?

I have attached the wireshark capture file below

Thank you !

ws_dump2.pcapng.zip