Hi Alex, On 18/09/14 11:43, Alexander Aring wrote: > On Thu, Sep 18, 2014 at 11:04:42AM +0100, Martin Townsend wrote: >> Hi Alex, >> >> If I'm following correctly you need to add a monitor interface as well as a node/coord interface to the PHY. so we would see wpan0 and wpanmon0 and then I could do a >> tcpdump -i wpanmon0? >> > mhhh, no. > > It's a question of design to have NODE, COORD and MONITOR parallel. > > But when we have phy mac handling for a iftype we should not have this > parallel. > > We have multiple interfaces support, BUT only ONE phy. > > The phy have also mac handling, like addressfilter XOR promiscousmode. > > The addressfilter doesn't interrupt the phy on ANY frame, only on frames > which belongs to us (the phy). That's why addressfilter makes sense on NODE and COORD. > After an interrupt the LINUX mac802154 stack also run a addressfilter to > be sure. (BUT only on NODE and COORD types). > > The MONITOR type bypass the mac802154 filters and send any frame to the > interface, then you can see it on wireshark. But this required to > disable the addressfilter of mac phy handling -> promiscousmode. > > Now having NODE and MONITOR parallel, you can't have promiscousmode and > addressfilter at the same time. promiscousmode disabled the > addressfilter. But then the LINUX mac802154 have a very workload because > it need to check any frame which is received on promiscousmode. This > isn't pracitcal, also promiscousmode isn't only addressfiltering also > CRC... Is monitor mode like the one in WIFI (rfmon) http://en.wikipedia.org/wiki/Monitor_mode Where it can't transmit packets, it basically turns the device into a packet sniffer? > > When you enable the promiscousmode on WPAN/NODE interface you only > enable that your cpu load increases because you don't have any phy > addressfilter anymore, then mac802154 do the job for you and remember a > MONITOR device bypass the mac802154 filtering, then you see ONLY on a > MONITOR interface every frame. Also frames which not in your pan or doesn' > belong to you. That's what's the monitor interface does. > > > More understandable? :/ Basically I want to be able to run tcpdump on wpan0 to capture packets but not effect the functionality of device so if it's a node or coordinator it carries on acting like one and the packet traffic capture would reflect this. So if I'm running as a coordinator and want to see RPL traffic that the coordinator generates and receives I can do this. My understanding is that I put the WPAN interface into promiscuous mode to do this. I accept that the CPU will come under more load but we are only talking about a 256kbps link. If you a running a linux distribution chances are you are using a fairly powerful ARM or equivalent processor. Are we saying this is not possible? > - Alex > -- > To unsubscribe from this list: send the line "unsubscribe linux-wpan" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html - Martin. -- To unsubscribe from this list: send the line "unsubscribe linux-wpan" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
