Re: Filtering in Monitor Mode (was Question about PRISM2 header rate field)

[Andy Green <andy@warmcat.com>]

Johannes Berg wrote:
> On Sun, 2007-03-04 at 22:10 -0500, Michael Wu wrote:
>> Note that modifying the management interface to do this is possible, but it 
>> would break hostap (and probably wpa_supplicant w/ MLME). Doing packet 
>> injection on monitor interfaces instead is safer in that regard.
> 
> But if you want to do injection over monitor interfaces we'll need to
> have the stupid mgmt interface hack around forever for the userspace
> MLME so it can receive only management traffic (even the non-promisc
> monitor iface we should have gets *far* too much traffic for a userspace
> MLME)

I used the libpcap filter stuff to limit what I saw to just the packets 
of interest.  This is the filtering that tcpdump uses to do the 
conditional filters like "port 22" or "host 192.168.0.1".  The filter 
uses something called BPF (Berkeley Packet Filter) which is done 
kernelside (at least libpcap is doing the filter install with ioctls in 
pcap-bpf.c).  So the cost of drinking from a Monitor firehose is much 
less than it sounds.

> Besides, to userspace, this is almost identical. In both cases it opens
> a socket, binds to something (either raw socket bound to netdev or
> netlink socket bound to nl80211) and then stuffs frames into that socket
> with some fixed header format (for most apps anyway)

I'm guessing the concern is to leave the crufty scary 
not-very-well-known Management Interface monster asleep lest it wake up 
while being edited and eat everyone :-)

-Andy