Ettercap/ettercap — pull request #117 by jacob-baines (2013-03-13 02:06:22+00:00)
Title: Added PPI Support and Fixed ec_wireless.c Ignoring QOS Data

The PPI (per packet information) header is a fairly popular link type for wireless captures. Most notably, the latest Kismet dumps packets in this format by default. The header is pretty simple for our purposes. We essentially need to get the header length and next link type and move to the next decoder.

More information about PPI can be found here: http://www.tcpdump.org/linktypes.html
A sample capture can be found here: http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=Http.cap

However, note that the above capture doesn't display much data if you don't pull in my ec_wireless.c changes. That is because ec_wireless.c drops all packets that contain the two byte QOS header. QOS is commonly found with data packets so I've added logic to handle that case. There is only one non-QOS-Data packet in the above capture so the change should be obvious.

Testing:
I tested using a couple of captures generated by Kismet and the above capture on Ubuntu 12.10. All seemed fine.