Subject: Question on sniffing with scapy - msg#00008

I have forwarded the question here since I think I can seek more help because currently I'm not using scapy for wireless stuffs.

---------- Forwarded message ----------
From: Tobias Kuehne <Tobias.Kuehne@xxxxxxxxxxxxxxxxxxxxxxxx>
Date: Dec 7, 2005 5:59 PM
Subject: Question on sniffing with scapy
To: geek00l@xxxxxxxxx

Hi!

I just found your blog http://geek00l.blogspot.com/ and read some posts
on scapy.

I've got a problem with it. I am trying to reinject 802.11 frames, using
an Atheros Card and the patched madwifi driver on Linux 2.4.31.

Also I'm sniffing the traffic, to see what it is reinjecting on another
machine with a prism 2 card.

The problem is: on every packet I sniff with scapy with

sniff(iface="ath0raw", filter="ether dst 00:09:5b:12:3d:5b", count = 1)

it adds 4 more bytes at the end and I don't know why... any idea?
An example follows.

Original:

10:11: 32.771600 DA:00:09:5b:12:3d:5b (oui Unknown) SA:00:11:24:23:cd:2f
(oui Unknown) BSSID:76:27:f2:22:ae:bc (oui Unknown) Data IV:bdef7a Pad 0
KeyID 0
         0x0000:  0840 d500 0009 5b12 3d5b 0011 2423 cd2f
         0x0010:  7627 f222 aebc f0ed 7aef bd00 3979 02c8
         0x0020:  1c98 dfd8 435e b7ab 4b5c f65f 02fc d945
         0x0030:  7937 732e 44f0 a986 60dc 4160 23ce 113d
         0x0040:  9f04 d899 31b2 ede0 620e 4e1f b9e8 a9b9
         0x0050:  401b 3669 f690 8900 976e da02 c3c5 a176
         0x0060:  fef6 1fc9 f506 e5d9 c2c5 1648 6901 6825
         0x0070:  d2dc 92ec ddb3 c526 666e d4dd

hexdump() of the packet that was sniffed with scapy:

08 40 D5 00 00 09 5B 12 3D 5B 00 11 24 23 CD 2F
76 27 F2 22 AE BC F0 ED 7A EF BD 00 39 79 02 C8
1C 98 DF D8 43 5E B7 AB 4B 5C F6 5F 02 FC D9 45
79 37 73 2E 44 F0 A9 86 60 DC 41 60 23 CE 11 3D
9F 04 D8 99 31 B2 ED E0 62 0E 4E 1F B9 E8 A9 B9
40 1B 36 69 F6 90 89 00 97 6E DA 02 C3 C5 A1 76
FE F6 1F C9 F5 06 E5 D9 C2 C5 16 48 69 01 68 25
D2 DC 92 EC DD B3 C5 26 66 6E D4 DD A6 49 80 2B


Best regards from Germany,

  Tobias.


--
Best Regards,

Lee