[Prism54-devel] Re: Active testing rules

[Jean-Baptiste Note]

Hello Feyd, dear list,

Feyd <feyd at seznam.cz> said :
> Here it is only three bytes.

That's because the buffer is aligned (the address is little-endian), and
you don't "see" the leading zeroes, but this is seen in many frame
types, i'm sure of the meaning.  While we're at it, all frames seem to
have their size 32-bit aligned ; i'll implement this too.

>
>> > 26-2c(37?): wep key
>> 

> The 01 is the "key present" I guess, the 05 the key length. Prism chips
> seem to support arbitrarily long keys (its very nice as all wep cracking
> tools I seen suppose 40 or 104 (ie so called 64 and 128) bits keys :).

Cool, i'll add this to the protocol header definitions. I wondered why
they lost so much space in the header ; i guess now i know the reason...

>> 
>> Please note that in the beacon  case, the frame starts at 4a, whereas in
>> the data case, the frame starts at 4c (noted on my site, generally, 4a
>> is for data, 4c is for management).
>
> Actualy I see all the frames begin at 4c..
>

No, have a look at your data frame, it starts with 08 41 (pure data
frame), 16 bits earlier (incidentally the MAC adresses are not aligned
as in the beacon case). The beacon frame starts with 40 00.

> I will return to the rest of your mail later, I'm in a hurry ATM.

thanks for taking the time to discuss this !

JB

-- 
Jean-Baptiste Note
+33 (0)6 83 03 42 38
jean-baptiste.note at wanadoo.fr