Re: Promiscuous patches

[Alexander Aring <alex.aring@gmail.com>]

On Thu, Sep 18, 2014 at 02:21:40PM +0200, Alexander Aring wrote:
...
> 
> I think you only want to have a wireshark on a interface.
> 
> wireshark/tcpdump whatever tolds you that the device is into
> promiscousmode. But this doesn't change anything also for wireless
> (802.11) because the multiple interface types, it's hard to handle it to change
> this during runtime. This is some historial issue when you don't have
> interface types like ethernet.
> 
> 
> I think we need to clarify that promiscousmode in a NODE/COORD makes no
> sense.
> 
> In userspace what you receive via wireshark/tcpdump makes no different
> (should not do any different) if you are in promiscousmode or not. Because
> the mac802154 filter packets like when the phy mac filters is
> activated.
> 
> If you have a MONITOR type, there is no mac802154 filter activated. And
> I mean with mac802154 the stack implementation of Linux kernel.
> 
> 
> Repeat:
> 
> If you have promiscousmode and NODE/COORD then you only increase the cpu
> load and there is (should) no different in userspace by capture with
> wireshark/tcpdump. You don't get more frames behind the mac802154 filter.
> 
> On MONITOR type this differs, because you don't have the mac802154 filter.
> 
> 
> Or I don't understand 100% what you meant here, sorry.
> 

I read now description of [0].

And now what 802.15.4-2011 says about the promiscousmode:

The second level of filtering shall be dependent on whether the MAC sublayer is currently operating in
promiscuous mode. In promiscuous mode, the MAC sublayer shall pass all frames received after the first
filter directly to the upper layers without applying any more filtering or processing. The MAC sublayer shall
be in promiscuous mode if macPromiscuousMode is set to TRUE.

There is lot of other description "simple disable all filtering". There
is no word about association with pan'ss.

This is for me the MONITOR mode. So MAYBE we could make some MONITOR
type which can associated with a PAN and then this can only show PAN
traffic. But when we can do this, when we support association with
pan's. :-) Then it's like promiscousmode what's desribed at [0].


[0] http://airsnort.shmoo.com/faq.html#Q3