functions.c

Go to the documentation of this file.

/* Linux Prism II Stumbler - Utility Scan for 802_11 networks under Linux
 * 
 * File : functions.c
 * Project : WifiScanner (c) 2002 Hervé Schauer Consultants
 * Usage : This utility is written for use with IEEE 802.11 adapters based
 * on Intersil's PRISM II chipset (PCMCIA).
 * 
 * Base code was from prismstumbler Jan Fernquist <Jan.B.Fernquist@telia.com>
 * and wlanctl from www.linux-wlan.com
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 * 
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 *
 * $Id: functions.c 177 2007-08-01 00:22:23Z poggij $
 */
#include <include.h>
#include <src/functions.h>
#include <src/analyse.h>
#include <src/crc-32.h>
#include <src/crt_io.h>
#include <src/conversion.h>
#include <getopt.h>
#ifdef WITH_SYSLOG
#include <syslog.h>
#endif
#ifdef HAVE_STDINT_H
#include <stdint.h>
#endif
#include "linux_ieee80211_radiotap.h"
#include "extract.h"
#include "cpack.h"

static const char svnid[] = "@(#) $Header:$";

/*
 * This two functions come from scanner.c
 */
void HelpAndBye(void);
void Bye(int ExitCode);

/*
 * Some internal forward refs
 */
int analyseBeacon(UINT8 * packet, int len);
int analyseProbeReq(UINT8 * packet, int len);
int analyseProbeRep(UINT8 * packet, int len);
int analyseCTS(UINT8 * packet);
int analyseRTS(UINT8 * packet);
int analyseACK(UINT8 * packet);
int analysePSPOLL(UINT8 * packet);
int analyseData(UINT8 * packet, int len);
int analyseMGMT(UINT8 * packet);        

void ProcessTagBits(UINT8 * packet, int len, int FrameType);
UINT8 dataIsCrypted(UINT8 * DataFrame, int len);

void HexMacToASCII(char DestMac[WLAN_STR_ADDR_LEN],
                   UINT8 a1[WLAN_ADDR_LEN]);

void IwFloat2Freq(double in_val, struct iw_freq *out_freq);

/*
 * Use globals, ugly but efficient
 */
extern struct sockaddr_nl nl_sk_addr;
extern ScanResult_t Res;
extern Statistics_t Stats;
extern WINDOW *Title_WND, *Panel_WND, *Sum_WND, *RealTime_WND;

//extern p80211_caphdr_t wlan_header;

/************************************/

/*
 * Same as safe_strncpy and snprintf, but always be sure the result is terminated.
 */

char *safe_strncpy(char *dst, const char *src, int size)
{
  dst[size - 1] = '\0';
  return strncpy(dst, src, size - 1);
}

int safe_snprintf(char *s, int size, char *fmt, ...)
{
  va_list ap;
  int ret;

  va_start(ap, fmt);
  ret = vsnprintf(s, size, fmt, ap);
  s[size - 1] = '\0';
  va_end(ap);

  return ret;
}

/*
 * Function to copy some data to buf, but no more data ...
 */
void *memcpy_buff(void *dest, const void *src, size_t n)
{
  if (n > MAX_BUFFER_SIZE) {
    debug(1, "ERROR : Packet is TOOO BIG size=%d\n", n);
    //DumpHexPaquets(RealTime_WND, dest, (MAX_BUFFER_SIZE + 0x10));
    return NULL;
  } else {
    return memcpy(dest, src, n);
  }

}

void HexMacToASCII(char DestMac[WLAN_STR_ADDR_LEN],
                   UINT8 a1[WLAN_ADDR_LEN])
{
  sprintf(DestMac, "%.2X:%.2X:%.2X:%.2X:%.2X:%.2X",
          a1[0], a1[1], a1[2], a1[3], a1[4], a1[5]);
}

/*
 * Function to check if the interface is existant
 */
int InterfaceIsExistant(char *devname)
{
  if (IfconfigSetFlags(devname, 0) == NO_ERROR)
    return TRUE;                // Existant
  else
    return FALSE;               // Not Existant
}

/*
 * Function to change interface flags UP, DOWN, PROMISC ...
 * IFF_UP, IFF_PROMISC, ... cf /usr/include/linux/if.h
 */
int IfconfigSetFlags(char *devname, short flags)
{
  struct ifreq ifr;
  int skfd;

  if ((skfd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
    debug(3, "SetIFFlags: Failed to create AF_INET "
          "DGRAM socket. %d:%s", errno, strerror(errno));
    return ERROR_CANT_CREATE_SOCKET;
  }
  // Fetch interface flags
  memset(&ifr, 0, sizeof ifr);
  strncpy(ifr.ifr_name, devname, sizeof(ifr.ifr_name) - 1);
  ifr.ifr_flags = flags;

  // do the IOCTL call
  if (ioctl(skfd, SIOCSIFFLAGS, &ifr) < 0) {
    debug(3, "SetIFFlags: Unknown interface %s: %s", devname,
          strerror(errno));
    close(skfd);
    return ERROR_UNKNOWN_INTERFACE;
  }
  close(skfd);
  return NO_ERROR;
}


/*
 * Convert a channel number in a frequency data
 */
void IwFloat2Freq(double in_val, struct iw_freq *out_freq)
{
  if (in_val <= 165) {
    out_freq->m = (uint32_t) in_val;
    out_freq->e = 0;
  } else {
    out_freq->e = (short) (floor(log10(in_val)));
    if (out_freq->e > 8) {
      out_freq->m =
          ((long) (floor(in_val / pow(10, out_freq->e - 6)))) * 100;
      out_freq->e -= 8;
    } else {
      out_freq->m = (uint32_t) in_val;
      out_freq->e = 0;
    }
  }
}

/*
 * Function to define the channel of a wireless interface (like iwconfig)
 */
int IwconfigSetChannel(char *devname, int channel)
{
  struct iwreq wrq;
  int skfd;

  if ((skfd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
    warning("Failed to create AF_INET DGRAM socket %d:%s", errno,
            strerror(errno));
    return ERROR_CANT_CREATE_SOCKET;
  }
  // Set a channel
  memset(&wrq, 0, sizeof(struct iwreq));

  strncpy(wrq.ifr_name, devname, IFNAMSIZ);
  wrq.u.freq.flags = IW_FREQ_FIXED;
  IwFloat2Freq(channel, &wrq.u.freq);

  // Try twice with a tiny delay, some cards (madwifi) need a second chance...
  if (ioctl(skfd, SIOCSIWFREQ, &wrq) < 0) {
    usleep(5000);
    if (ioctl(skfd, SIOCSIWFREQ, &wrq) < 0) {
      debug(3, "Failed to set channel %d %d:%s\n", channel,
            errno, strerror(errno));
      close(skfd);
      return ERROR_CANT_SET_CHANNEL;
    }
  }

  close(skfd);
  return NO_ERROR;
}

/*
 * Set mode of a wireless interface
 */
int IwconfigSetMode(char *devname, __u32 mode)
{
  // cf wireless.h
  struct iwreq wrq;
  int skfd;

  if ((skfd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
    warning("Failed to create AF_INET DGRAM socket %d:%s\n", errno,
            strerror(errno));
    return ERROR_CANT_CREATE_SOCKET;
  }

  memset(&wrq, 0, sizeof(struct iwreq));
  strncpy(wrq.ifr_name, devname, IFNAMSIZ);
  wrq.u.mode = mode;

  if (ioctl(skfd, SIOCSIWMODE, &wrq) < 0) {
    warning("mode set ioctl failed %d:%s\n", errno, strerror(errno));
    close(skfd);
    return ERROR_CANT_SET_MODE;
  }

  close(skfd);
  return NO_ERROR;
}

/*
 * Clear the SSID
 */
int IwconfigClearSSID(char *devname)
{
  struct iwreq wrq;
  int skfd;
  char essid[1];

  essid[0] = '\0';

  if ((skfd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
    warning("Failed to create AF_INET DGRAM socket %d:%s", errno,
            strerror(errno));
    return ERROR_CANT_CREATE_SOCKET;
  }
  // Zero the ssid
  strncpy(wrq.ifr_name, devname, IFNAMSIZ);
  wrq.u.essid.pointer = (caddr_t) essid;
  wrq.u.essid.length = 1;
  wrq.u.essid.flags = 1;

  if (ioctl(skfd, SIOCSIWESSID, &wrq) < 0) {
    warning("Failed to set SSID %d:%s", errno, strerror(errno));
    close(skfd);
    return ERROR_CANT_SET_SSID;
  }

  close(skfd);
  return 0;

}

/*
 * Do an private IOCTL
 * Code stolen from Kismet, that was stolen from wireless_tools ;-)
 */
int Iwconfig_Set_IntPriv(const char *devname, const char *privcmd,
                         int val1, int val2)
{
  struct iwreq wrq;
  int skfd;
  struct iw_priv_args priv[IW_MAX_PRIV_DEF];
  u_char buffer[4096];
  int subcmd = 0;
  int offset = 0;

  memset(priv, 0, sizeof(priv));

  if ((skfd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
    return ERROR_CANT_CREATE_SOCKET;
  }

  memset(&wrq, 0, sizeof(struct iwreq));
  strncpy(wrq.ifr_name, devname, IFNAMSIZ);

  wrq.u.data.pointer = (caddr_t) priv;
  wrq.u.data.length = IW_MAX_PRIV_DEF;
  wrq.u.data.flags = 0;

  if (ioctl(skfd, SIOCGIWPRIV, &wrq) < 0) {
    close(skfd);
    return IWPRIV_FAILED_TO_RETREIVE_IOCTL_LIST;
  }

  int pn = -1;
  while ((++pn < wrq.u.data.length) && strcmp(priv[pn].name, privcmd));

  if (pn == wrq.u.data.length) {
    close(skfd);
    return IWPRIV_FAILED_TO_FIND_IOCTL;
  }
  // Find subcmds, as if this isn't ugly enough already
  if (priv[pn].cmd < SIOCDEVPRIVATE) {
    int j = -1;

    while ((++j < wrq.u.data.length) &&
           ((priv[j].name[0] != '\0') ||
            (priv[j].set_args != priv[pn].set_args) ||
            (priv[j].get_args != priv[pn].get_args)
           ));

    if (j == wrq.u.data.length) {
      close(skfd);
      return IWPRIV_FAILED_TO_FIND_SUBIOCTL;
    }

    subcmd = priv[pn].cmd;
    offset = sizeof(__u32);
    pn = j;
  }
  // Make sure its an iwpriv we can set
  if ((priv[pn].set_args & IW_PRIV_TYPE_MASK) == 0 ||
      (priv[pn].set_args & IW_PRIV_SIZE_MASK) == 0) {
    close(skfd);
    return IWPRIV_FAILED_TO_SET_VALUE;
  }

  if ((priv[pn].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_INT) {
    close(skfd);
    return IWPRIV_DOES_NOT_ACCEPT_INTEGER;
  }
  // Find out how many arguments it takes and die if we can't handle it
  int nargs = (priv[pn].set_args & IW_PRIV_SIZE_MASK);
  if (nargs > 2) {
    close(skfd);
    return IWPRIV_NEED_MORE_THAN_2_ARG;
  }
  // Build the set request
  memset(&wrq, 0, sizeof(struct iwreq));
  strncpy(wrq.ifr_name, devname, IFNAMSIZ);

  // Assign the arguments
  wrq.u.data.length = nargs;
  ((__s32 *) buffer)[0] = (__s32) val1;
  if (nargs > 1) {
    ((__s32 *) buffer)[1] = (__s32) val2;
  }
  // This is terrible!
  // This is also simplified from what iwpriv.c does, because we don't
  // need to worry about get-no-set ioctls
  if ((priv[pn].set_args & IW_PRIV_SIZE_FIXED) &&
      ((sizeof(__u32) * nargs) + offset <= IFNAMSIZ)) {
    if (offset)
      wrq.u.mode = subcmd;
    memcpy(wrq.u.name + offset, buffer, IFNAMSIZ - offset);
  } else {
    wrq.u.data.pointer = (caddr_t) buffer;
    wrq.u.data.flags = 0;
  }

  // Actually do it.
  if (ioctl(skfd, priv[pn].cmd, &wrq) < 0) {
    close(skfd);
    return IWPRIV_FAILED_TO_SET_IOCTL;
  }

  close(skfd);
  return NO_ERROR;
}





/*
 * Function to detect if a packet is encrypted
 * How to detect a crypted packet ?
 * Take a look at airsnort ;-)
 */
UINT8 dataIsCrypted(UINT8 * DataFrame, int len)
{
  UINT8 ret = 0;
  UINT8 fc_wep = 0;
  FixedField_t *FixedField;

  p80211_hdr_t *d80211b_Header;
  //(UINT8 *) d80211b_Header = DataFrame;
  d80211b_Header = (p80211_hdr_t *) DataFrame;

  UINT8 IndexData = 24;
  //(char *) FixedField = DataFrame + sizeof(p80211_hdr_a3_t);
  FixedField = (FixedField_t *) DataFrame + sizeof(p80211_hdr_a3_t);

  // if it's a 4 MAC
  // ---------------
  if (WLAN_GET_FC_TODS(d80211b_Header->a3.fc)
      && WLAN_GET_FC_FROMDS(d80211b_Header->a3.fc)) {
    IndexData = 30;
  }

  fc_wep = WLAN_GET_MGMT_CAP_INFO_PRIVACY(FixedField->cap_info);

  //                    SNAP                       NetBIOS
  //if ((DataFrame[IndexData] == 0xAA) || (DataFrame[IndexData] == 0xF0))
  //if (DataFrame[IndexData] == 0xAA)
  if ((fc_wep == 0) &&
      ((DataFrame[IndexData] == 0xAA) &&
       (DataFrame[IndexData + 1] == 0xAA))) {
    ret = 0;
  } else {
    ret = 1;
    Stats.CryptedPackets++;

    if (IS_BIT_SET(DataFrame[IndexData + 3], 5)) {
      debug(3, "Extended IV detected\n");
      ret += 2;
      // This is some WPA data, because bit 2 if is set it's an extended IV
    } else {
      // This is an old WEP data packet
      // is there some crypted data in packet ?
      if (len > (IndexData + 4)) {
        // TODO : Check if it was x86/ppc compatible code
        // Save IV and key number
        // IV:IV:IV:
        Res.IV[0] = DataFrame[IndexData + 0];
        Res.IV[1] = DataFrame[IndexData + 1];
        Res.IV[2] = DataFrame[IndexData + 2];
        Res.IV[3] = DataFrame[IndexData + 3];
        Stats.IV[0] = DataFrame[IndexData + 0];
        Stats.IV[1] = DataFrame[IndexData + 1];
        Stats.IV[2] = DataFrame[IndexData + 2];
        Stats.IV[3] = DataFrame[IndexData + 3];

        // Check if it's a Weak IV
        // For more Information take a look at :
        // http://www.dachb0den.com/projects/bsd-airtools/wepexp.txt
        // Code is Ok for x86/ppc
        if ((Res.IV[1] == 255 && Res.IV[0] > 2 && Res.IV[0] < 16)
            || ((Res.IV[0] + Res.IV[1]) == 1
                && (Res.IV[2] <= 0x0A || Res.IV[2] == 0xFF))
            || ((Res.IV[0] + Res.IV[1]) <= 0x0C
                && (Res.IV[2] >= 0xF2 && Res.IV[2] <= 0xFE
                    && Res.IV[2] != 0xFD)))
          Stats.WeakIV++;

      }
    }
  }
  return ret;
}

// Update Res.OtherInformation
void UpdateOtherInformation(char *Buff)
{
  char Buff2[MAXSIZE_OTHERINFORMATION + 1];

  safe_strncpy(Buff2, Res.OtherInformation, MAXSIZE_OTHERINFORMATION);
  if ((strlen(Buff) + strlen(Buff2)) > (MAXSIZE_OTHERINFORMATION - 3))
    snprintf(Res.OtherInformation, MAXSIZE_OTHERINFORMATION,
             "%s - %s", Buff2, Buff);
  else
    sprintf(Res.OtherInformation, "%s - %s", Buff2, Buff);

  debug(2, "--- Processing UpdateOtherInformation : %s ---\n", Buff);

}

/*
 * Get the different data from the MGMT header. Fill global struct
 */
int processPacket(p80211_caphdr_t * wlan_header, UINT8 * packet, int len)
{
  int ReturnCode = 0;
  UINT32 CRC;

  p80211_hdr_t *d80211b_Header;

  d80211b_Header = (p80211_hdr_t *) packet;
  Res.TypeSubtype = d80211b_Header->a3.fc;

  Res.Signal = wlan_header->ssi_signal;
  Res.Noise = wlan_header->ssi_noise;
  Res.Rate = wlan_header->datarate;

  switch (WLAN_GET_FC_FTYPE(d80211b_Header->a3.fc)) {
    /* Frame subtypes */
  case WLAN_FTYPE_MGMT:
    debug(1, "Process Management Frame\n");
    /* Management */
    switch (WLAN_GET_FC_FSTYPE(d80211b_Header->a3.fc)) {
    case WLAN_FSTYPE_ASSOCREQ: // To be analyse
    case WLAN_FSTYPE_ASSOCRESP:
    case WLAN_FSTYPE_REASSOCREQ:
    case WLAN_FSTYPE_REASSOCRESP:
      ReturnCode = analyseMGMT(packet);
      break;
    case WLAN_FSTYPE_PROBEREQ:
      ReturnCode = analyseProbeReq(packet, len);
      break;
    case WLAN_FSTYPE_PROBERESP:
      ReturnCode = analyseProbeRep(packet, len);
      break;
    case WLAN_FSTYPE_BEACON:
      ReturnCode = analyseBeacon(packet, len);
      Stats.Beacon++;
      break;
    case WLAN_FSTYPE_ATIM:
    case WLAN_FSTYPE_DISASSOC:
    case WLAN_FSTYPE_AUTHEN:
      ReturnCode = analyseMGMT(packet);
      break;
    case WLAN_FSTYPE_DEAUTHEN:
      // TODO : Clear BSSID of the Deauthenticated Client
      ReturnCode = analyseMGMT(packet);
      break;
    case WLAN_FSTYPE_ACTION:
      warning("Whaooou a packet what I search ! : MANAGEMENT/ACTION\n");
      break;
    }
    break;
  case WLAN_FTYPE_CTL:
    debug(1, "Process Control Frame\n");
    switch (WLAN_GET_FC_FSTYPE(d80211b_Header->a3.fc)) {
      /* Control */
    case WLAN_FSTYPE_BLOCK_ACK_REQ:
      warning
          ("Whaooou a packet what I search ! : CONTROL/BLOCK_ACK_REQ\n");
      break;
    case WLAN_FSTYPE_BLOCK_ACK:
      warning("Whaooou a packet what I search ! : CONTROL/BLOCK_ACK\n");
      break;
    case WLAN_FSTYPE_PSPOLL:
      ReturnCode = analysePSPOLL(packet);
      break;
    case WLAN_FSTYPE_RTS:
      ReturnCode = analyseRTS(packet);
      break;
    case WLAN_FSTYPE_CTS:
      ReturnCode = analyseCTS(packet);
      break;
    case WLAN_FSTYPE_ACK:
      ReturnCode = analyseACK(packet);
      break;
    case WLAN_FSTYPE_CFEND:
      break;
    case WLAN_FSTYPE_CFENDCFACK:
      break;
    }
    break;
  case WLAN_FTYPE_DATA:
    debug(1, "Process Data Frame\n");
    //CLEAR_TYPE_BIT_AP (Res.TypeOfClient);
    SET_TYPE_BIT_DATA(Res.TypeOfClient);
    switch (WLAN_GET_FC_FSTYPE(d80211b_Header->a3.fc) & (WLAN_FSTYPE_QOS_UNMASK)) {
      /* Data */
    case WLAN_FSTYPE_DATAONLY:
    case WLAN_FSTYPE_DATA_CFACK:
    case WLAN_FSTYPE_DATA_CFPOLL:
    case WLAN_FSTYPE_DATA_CFACK_CFPOLL:
    case WLAN_FSTYPE_NULL:
      ReturnCode = analyseData(packet, len);
      break;
    case WLAN_FSTYPE_CFACK:
      break;
    case WLAN_FSTYPE_CFPOLL:
      break;
    case WLAN_FSTYPE_CFACK_CFPOLL:
      break;
    }
    break;
  }

  memcpy(&CRC, packet + len - 4, 4);

/*
// Check if the packet is a good packet
#ifndef LWNG_15
  if ((CRC == 0xFFFFFFFF)
      || ((unsigned) len < sizeof (p80211msg_lnxind_wlansniffrm_t))) {
#else
  if ((unsigned) len < sizeof(p80211msg_lnxind_wlansniffrm_t)) {
#endif
    if (DebugLevel >= 1) {
      debug(0, "INVALID PACKET : BAD CRC (%08X) or too short (%04X)\n",
            CRC, len);
      if ((unsigned) len > sizeof(p80211msg_lnxind_wlansniffrm_t)) {
        CRC =
            doFCS(&packet[sizeof(p80211msg_lnxind_wlansniffrm_t)],
                  (len - 4 - sizeof(p80211msg_lnxind_wlansniffrm_t)));
        debug(1, "Calculed CRC is : %08X\n", CRC);
      }
    }
    safe_strncpy(Res.TypeOfPacket, "INVLID", WLAN_SIZEOF_TYPEOFPACKET);
    Stats.INVLD++;
    ReturnCode = 0;
  } else {
*/

  // Copy type of packet (in text)
  safe_strncpy(Res.TypeOfPacket,
               TypeOfPacketToString(d80211b_Header->a3.fc),
               WLAN_SIZEOF_TYPEOFPACKET);
  //}

  debug(1, "FrameType=%04X (type:%X subtype:%X)\n",
        d80211b_Header->a3.fc,
        WLAN_GET_FC_FTYPE(d80211b_Header->a3.fc),
        WLAN_GET_FC_FSTYPE(d80211b_Header->a3.fc));

  return ReturnCode;
}

/* ***
 * Functions of Analyse
 */

int analyseBeacon(UINT8 * packet, int len)
{
  p80211_hdr_t *d80211b_Header;
  FixedField_t *FixedField;

  d80211b_Header = (p80211_hdr_t *) packet;
  FixedField = (UINT8 *) packet + sizeof(p80211_hdr_a3_t);

#if 0
  debug(0, "FixedField = %0x\n", FixedField);
  DumpHexPaquets(RealTime_WND, packet, 0x20);
  DumpHexPaquets(RealTime_WND, FixedField, 0x10);
#endif

  HexMacToASCII(Res.DestMac, d80211b_Header->a3.a1);
  HexMacToASCII(Res.SrcMac, d80211b_Header->a3.a2);
  HexMacToASCII(Res.BssId, d80211b_Header->a3.a3);

  //Res.isAp = WLAN_GET_MGMT_CAP_INFO_ESS(FixedField->cap_info);
  Res.hasWep = WLAN_GET_MGMT_CAP_INFO_PRIVACY(FixedField->cap_info);
  // TODO : detect if WPA is used and change the 0 by 1 or 0
  // it will do in the analyse of the tagged parameters
  Res.hasWPA = 0;

  /* Log */
  LogDetectedClient(d80211b_Header->a3.a2);
  LogPutSN(d80211b_Header->a3.a2, Res.Signal);
  LogPutRate(d80211b_Header->a3.a2, Res.Rate);
  // Here we know if it's an AP or an Ah-Hoc client
  SET_TYPE_BIT_BEACON(Res.TypeOfClient);
  debug(3, "IBSS = %0x - ESS = %0x\n",
        WLAN_GET_MGMT_CAP_INFO_IBSS(FixedField->cap_info),
        WLAN_GET_MGMT_CAP_INFO_ESS(FixedField->cap_info));
  if (WLAN_GET_MGMT_CAP_INFO_IBSS(FixedField->cap_info)) {
    SET_TYPE_BIT_P2P(Res.TypeOfClient);
    CLEAR_TYPE_BIT_AP(Res.TypeOfClient);
    LogPutIsP2P(d80211b_Header->a3.a2, Res.hasWep, FixedField->bcn_int);
  } else {
    CLEAR_TYPE_BIT_P2P(Res.TypeOfClient);
    if (WLAN_GET_MGMT_CAP_INFO_ESS(FixedField->cap_info)) {
      SET_TYPE_BIT_AP(Res.TypeOfClient);
      LogPutIsAP(d80211b_Header->a3.a2, Res.hasWep, Res.hasWPA,
                 FixedField->bcn_int);
    } else {
      CLEAR_TYPE_BIT_AP(Res.TypeOfClient);
    }
  }
  LogPutBSSID(d80211b_Header->a3.a2, d80211b_Header->a3.a3);
  LogPutTimestamp(d80211b_Header->a3.a2, FixedField->ts);
  LogPutSeqNum(d80211b_Header->a3.a2, Res.DestMac, d80211b_Header->a3.seq);

  debug(1,
        "Dst:%s Src:%s Bssid:%s\n" "Fragment number : 0x%04X\n"
        "Sequence number : 0x%02X\n" "Timestamp : 0x%016llX\n"
        "Beacon Interval : 0x%X\n" "Capabilities : 0x%X\n"
        "S/N : %ld/%ld\n", Res.DestMac, Res.SrcMac, Res.BssId,
        WLAN_GET_SEQ_FRGNUM(d80211b_Header->a3.seq),
        WLAN_GET_SEQ_SEQNUM(d80211b_Header->a3.seq), FixedField->ts,
        FixedField->bcn_int, FixedField->cap_info, Res.Signal, Res.Noise);

  if ((unsigned int) len <= (sizeof(p80211_hdr_t) + sizeof(FixedField_t)))
    return FALSE;

  ProcessTagBits(packet, len, WLAN_FSTYPE_BEACON);

  return TRUE;
}

/*************************/

int analyseProbeReq(UINT8 * packet, int len)
{
  p80211_hdr_t *d80211b_Header;
  FixedField_t *FixedField;

  //(UINT8 *) d80211b_Header = packet;
  //(char *) FixedField = packet + sizeof(p80211_hdr_a3_t);
  FixedField = (UINT8 *) packet + sizeof(p80211_hdr_a3_t);
  d80211b_Header = (p80211_hdr_t *) packet;

  HexMacToASCII(Res.DestMac, d80211b_Header->a3.a1);
  HexMacToASCII(Res.SrcMac, d80211b_Header->a3.a2);
  HexMacToASCII(Res.BssId, d80211b_Header->a3.a3);

  debug(1,
        "Dst:%s Src:%s Bssid:%s\n" "Fragment number : 0x%04X\n"
        "Sequence number : 0x%02X\n" "S/N : %ld/%ld\n", Res.DestMac,
        Res.SrcMac, Res.BssId,
        WLAN_GET_SEQ_FRGNUM(d80211b_Header->a3.seq),
        WLAN_GET_SEQ_SEQNUM(d80211b_Header->a3.seq), Res.Signal,
        Res.Noise);

  /* Log */
  LogDetectedClient(d80211b_Header->a3.a2);
  LogPutSN(d80211b_Header->a3.a2, Res.Signal);
  LogPutRate(d80211b_Header->a3.a2, Res.Rate);
  //LogPutIsAP (d80211b_Header->a3.a2, Res.hasWep, Res.hasWPA, FixedField->bcn_int);
  LogPutBSSID(d80211b_Header->a3.a2, d80211b_Header->a3.a3);
  LogPutSeqNum(d80211b_Header->a3.a2, Res.DestMac, d80211b_Header->a3.seq);

  Res.hasWep = WLAN_GET_MGMT_CAP_INFO_PRIVACY(FixedField->cap_info);
  // TODO : detect if WPA is used and change the 0 by 1 or 0
  // it will done in the analyse of the tagged parameters
  Res.hasWPA = 0;

  ProcessTagBits(packet, len, WLAN_FSTYPE_PROBEREQ);

  //Res.isAp = WLAN_GET_MGMT_CAP_INFO_ESS(FixedField->cap_info);

  return TRUE;                  /* All is OK */
}

/*************************/

int analyseProbeRep(UINT8 * packet, int len)
{
  p80211_hdr_t *d80211b_Header;
  FixedField_t *FixedField;

  //(UINT8 *) d80211b_Header = packet;
  //(char *) FixedField = packet + sizeof(p80211_hdr_a3_t);
  d80211b_Header = (p80211_hdr_t *) packet;
  FixedField = (UINT8 *) packet + sizeof(p80211_hdr_a3_t);

  HexMacToASCII(Res.DestMac, d80211b_Header->a3.a1);
  HexMacToASCII(Res.SrcMac, d80211b_Header->a3.a2);
  HexMacToASCII(Res.BssId, d80211b_Header->a3.a3);

  debug(1,
        "Dst:%s Src:%s Bssid:%s\n" "Fragment number : 0x%04X\n"
        "Sequence number : 0x%02X\n" "Timestamp : 0x%016llX\n"
        "Capabilities : 0x%X\n" "S/N : %ld/%ld\n", Res.DestMac,
        Res.SrcMac, Res.BssId,
        WLAN_GET_SEQ_FRGNUM(d80211b_Header->a3.seq),
        WLAN_GET_SEQ_SEQNUM(d80211b_Header->a3.seq), FixedField->ts,
        FixedField->cap_info, Res.Signal, Res.Noise);

  /* Log */
  LogDetectedClient(d80211b_Header->a3.a1);
  /* STA */
  LogDetectedClient(d80211b_Header->a3.a2);     /* AP */

  LogPutSN(d80211b_Header->a3.a2, Res.Signal);
  LogPutRate(d80211b_Header->a3.a2, Res.Rate);
  LogPutIsAP(d80211b_Header->a3.a2,
             WLAN_GET_MGMT_CAP_INFO_PRIVACY(FixedField->cap_info), 0,
             FixedField->bcn_int);
  LogPutBSSID(d80211b_Header->a3.a2, d80211b_Header->a3.a3);
  LogPutTimestamp(d80211b_Header->a3.a2, FixedField->ts);
  LogPutSeqNum(d80211b_Header->a3.a2, Res.DestMac, d80211b_Header->a3.seq);

  //Res.isAp = WLAN_GET_MGMT_CAP_INFO_ESS(FixedField->cap_info);
  Res.hasWep = WLAN_GET_MGMT_CAP_INFO_PRIVACY(FixedField->cap_info);
  // TODO : detect if WPA is used and change the 0 by 1 or 0
  Res.hasWPA = 0;
  // it will do in the analyse of the tagged parameters

  if (WLAN_GET_MGMT_CAP_INFO_IBSS(FixedField->cap_info)) {
    SET_TYPE_BIT_P2P(Res.TypeOfClient);
    CLEAR_TYPE_BIT_AP(Res.TypeOfClient);
    LogPutIsP2P(d80211b_Header->a3.a2, Res.hasWep, 0);
  } else {
    CLEAR_TYPE_BIT_P2P(Res.TypeOfClient);
    if (WLAN_GET_MGMT_CAP_INFO_ESS(FixedField->cap_info)) {
      SET_TYPE_BIT_AP(Res.TypeOfClient);
      LogPutIsAP(d80211b_Header->a3.a2, Res.hasWep, Res.hasWPA, 0);
    } else {
      CLEAR_TYPE_BIT_AP(Res.TypeOfClient);
    }
  }
  ProcessTagBits(packet, len, WLAN_FSTYPE_PROBERESP);

  return TRUE;                  /* All is OK */
}


/**********/

int analyseRTS(UINT8 * packet)
{
  p80211_hdr_t *d80211b_Header;

  //(UINT8 *) d80211b_Header = packet;
  d80211b_Header = (p80211_hdr_t *) packet;

  debug(1, "FC=%X", d80211b_Header->a3.fc);

  HexMacToASCII(Res.DestMac, d80211b_Header->a3.a1);
  HexMacToASCII(Res.SrcMac, d80211b_Header->a3.a2);
  safe_strncpy(Res.BssId, "00:00:00:00:00:00", WLAN_STR_ADDR_LEN);
  /* Log */
  LogDetectedClient(d80211b_Header->a3.a1);     /* STA */
  LogDetectedClient(d80211b_Header->a3.a2);     /* AP */
  LogPutSN(d80211b_Header->a3.a3, Res.Signal);
  LogPutRate(d80211b_Header->a3.a3, Res.Rate);

  return TRUE;                  /* All is OK */
}

int analyseCTS(UINT8 * packet)
{
  p80211_hdr_t *d80211b_Header;

  //(UINT8 *) d80211b_Header = packet;
  d80211b_Header = (p80211_hdr_t *) packet;

  debug(1, "FC=%X", d80211b_Header->a3.fc);

  HexMacToASCII(Res.DestMac, d80211b_Header->a3.a1);
  safe_strncpy(Res.SrcMac, "00:00:00:00:00:00", WLAN_STR_ADDR_LEN);
  safe_strncpy(Res.BssId, "00:00:00:00:00:00", WLAN_STR_ADDR_LEN);
  /* Log */
  LogDetectedClient(d80211b_Header->a3.a1);     /* STA */

  return TRUE;                  /* All is OK */
}

/*
 * Function to analyse an Acknoledge frame
 */ int analyseACK(
                    UINT8 * packet)
{
  p80211_hdr_t *d80211b_Header;

  //(UINT8 *) d80211b_Header = packet;
  d80211b_Header = (p80211_hdr_t *) packet;

  debug(1, "FC=%X", d80211b_Header->a3.fc);

  HexMacToASCII(Res.DestMac, d80211b_Header->a3.a1);
  safe_strncpy(Res.SrcMac, "00:00:00:00:00:00", WLAN_STR_ADDR_LEN);
  safe_strncpy(Res.BssId, "00:00:00:00:00:00", WLAN_STR_ADDR_LEN);
  /* Log */
  LogDetectedClient(d80211b_Header->a3.a1);     /* STA or AP */

  return TRUE;                  /* All is OK */
}

int analysePSPOLL(UINT8 * packet)
{
  p80211_hdr_t *d80211b_Header;

  //(UINT8 *) d80211b_Header = packet;
  d80211b_Header = (p80211_hdr_t *) packet;

  debug(1, "FC=%X", d80211b_Header->a3.fc);

  HexMacToASCII(Res.SrcMac, d80211b_Header->a3.a1);
  safe_strncpy(Res.DestMac, "00:00:00:00:00:00", WLAN_STR_ADDR_LEN);
  HexMacToASCII(Res.BssId, d80211b_Header->a3.a2);
  /* Log */
  LogDetectedClient(d80211b_Header->a3.a1);     /* STA */
  LogPutSN(d80211b_Header->a3.a1, Res.Signal);
  LogPutRate(d80211b_Header->a3.a1, Res.Rate);
  LogPutSeqNum(d80211b_Header->a3.a1, Res.DestMac, d80211b_Header->a3.seq);

  return TRUE;                  /* All is OK */
}

/*
 * Function to analyse and parse a Data Frame
 */ int analyseData(
                     UINT8 * packet, int len)
{
  p80211_hdr_t *d80211b_Header;
  char strAddresse1[WLAN_STR_ADDR_LEN];
  char strAddresse2[WLAN_STR_ADDR_LEN];
  char strAddresse3[WLAN_STR_ADDR_LEN];
  FixedField_t *FixedField;

  //(UINT8 *) d80211b_Header = packet;
  //(char *) FixedField = packet + sizeof(p80211_hdr_a3_t);
  d80211b_Header = (p80211_hdr_t *) packet;

  FixedField = (FixedField_t *) packet + sizeof(p80211_hdr_a3_t);

  if ((WLAN_GET_FC_FSTYPE(d80211b_Header->a3.fc) & WLAN_FSTYPE_QOS_MASK) != 0) {
    // skip the 2 bytes of QOS
    FixedField = FixedField + 2;
  }

  HexMacToASCII(strAddresse1, d80211b_Header->a3.a1);
  HexMacToASCII(strAddresse2, d80211b_Header->a3.a2);
  HexMacToASCII(strAddresse3, d80211b_Header->a3.a3);

  debug(1, "FC=%X", d80211b_Header->a3.fc);
  debug(1, "Packet Size=%d\n", 0);

  if (WLAN_GET_FC_TODS(d80211b_Header->a3.fc)) {
    if (WLAN_GET_FC_FROMDS(d80211b_Header->a3.fc)) {
      // Data From AP by AP to STA
      debug(2, " AP to AP");

      SET_TYPE_BIT_TODS(Res.TypeOfClient);
      SET_TYPE_BIT_FROMDS(Res.TypeOfClient);

      LogDetectedClient(d80211b_Header->a3.a1);
      LogDetectedClient(d80211b_Header->a3.a2);
      LogDetectedClient(d80211b_Header->a3.a3);

      safe_strncpy(Res.SrcMac, strAddresse2, WLAN_STR_ADDR_LEN);
      safe_strncpy(Res.DestMac, strAddresse3, WLAN_STR_ADDR_LEN);
      safe_strncpy(Res.BssId, "00:00:00:00:00:00", WLAN_STR_ADDR_LEN);
      /* Log */
      LogPutSN(d80211b_Header->a3.a1, Res.Signal);
      LogPutRate(d80211b_Header->a3.a1, Res.Rate);
      LogPutIsAP(d80211b_Header->a3.a2,
                 WLAN_GET_MGMT_CAP_INFO_PRIVACY
                 (FixedField->cap_info), Res.hasWPA, FixedField->bcn_int);
      //Res.isAp = 1;
      SET_TYPE_BIT_AP(Res.TypeOfClient);
    } else {
      // Data from DS to STA
      debug(1, " TODS");
      SET_TYPE_BIT_TODS(Res.TypeOfClient);

      safe_strncpy(Res.BssId, strAddresse1, WLAN_STR_ADDR_LEN);
      safe_strncpy(Res.SrcMac, strAddresse2, WLAN_STR_ADDR_LEN);
      safe_strncpy(Res.DestMac, strAddresse3, WLAN_STR_ADDR_LEN);
      /* Log */
      LogDetectedClient(d80211b_Header->a3.a2);
      LogPutSN(d80211b_Header->a3.a2, Res.Signal);
      LogPutRate(d80211b_Header->a3.a2, Res.Rate);
      //LogPutIsAP (d80211b_Header->a3.a2, Res.hasWep, Res.hasWPA, FixedField->bcn_int);
      LogPutBSSID(d80211b_Header->a3.a2, d80211b_Header->a3.a1);
      //LogPutDS (d80211b_Header->a3.a3);
    }
  } else if (WLAN_GET_FC_FROMDS(d80211b_Header->a3.fc)) {
    // Data to DS to STA
    debug(1, " FROMDS");

    SET_TYPE_BIT_FROMDS(Res.TypeOfClient);

    safe_strncpy(Res.DestMac, strAddresse1, WLAN_STR_ADDR_LEN);
    safe_strncpy(Res.BssId, strAddresse2, WLAN_STR_ADDR_LEN);
    safe_strncpy(Res.SrcMac, strAddresse3, WLAN_STR_ADDR_LEN);
    /* Log */
    LogDetectedClient(d80211b_Header->a3.a3);
    LogPutSN(d80211b_Header->a3.a3, Res.Signal);
    LogPutRate(d80211b_Header->a3.a3, Res.Rate);
    LogPutBSSID(d80211b_Header->a3.a3, d80211b_Header->a3.a2);
    LogPutDS(d80211b_Header->a3.a3);
  } else {
    // Data from STA to STA
    debug(1, " STA to STA");

    safe_strncpy(Res.DestMac, strAddresse1, WLAN_STR_ADDR_LEN);
    safe_strncpy(Res.SrcMac, strAddresse2, WLAN_STR_ADDR_LEN);
    safe_strncpy(Res.BssId, strAddresse3, WLAN_STR_ADDR_LEN);
    /* Log */
    LogDetectedClient(d80211b_Header->a3.a1);
    LogDetectedClient(d80211b_Header->a3.a2);
    LogPutSN(d80211b_Header->a3.a2, Res.Signal);
    LogPutRate(d80211b_Header->a3.a2, Res.Rate);
    LogPutBSSID(d80211b_Header->a3.a2, d80211b_Header->a3.a3);
  }

  debug(1, "\n");

  // If it's a NULL Function Packet : 
  //    do not fill IV and do not try to detect if it crypted
  if (WLAN_GET_FC_FSTYPE(d80211b_Header->a3.fc) != WLAN_FSTYPE_NULL) {
    register UINT8 res;
    res = dataIsCrypted(packet, len);
    Res.hasWep = IS_BIT_SET(res, 0);
    Res.hasWPA = IS_BIT_SET(res, 1);
  }
  // TODO : put LastIV in Struct ClientInfo

  return TRUE;                  /* All is OK */
}

int analyseMGMT(UINT8 * packet)
{
  p80211_hdr_t *d80211b_Header;

  //(UINT8 *) d80211b_Header = packet;
  d80211b_Header = (p80211_hdr_t *) packet;

  HexMacToASCII(Res.DestMac, d80211b_Header->a3.a1);
  HexMacToASCII(Res.SrcMac, d80211b_Header->a3.a2);
  HexMacToASCII(Res.BssId, d80211b_Header->a3.a3);

  debug(1, "FC=%X", d80211b_Header->a3.fc);

  /* Log */
  LogDetectedClient(d80211b_Header->a3.a1);
  LogDetectedClient(d80211b_Header->a3.a2);
  LogPutSN(d80211b_Header->a3.a2, Res.Signal);
  LogPutRate(d80211b_Header->a3.a2, Res.Rate);
  LogPutSeqNum(d80211b_Header->a3.a2, Res.DestMac, d80211b_Header->a3.seq);

  return TRUE;                  /* All is OK */
}

// Function to filter not printable caractere in some SSID
UINT8 FilterESSID(char *ESSID)
{
  UINT8 i;
  UINT8 modified = FALSE;

  for (i = 0; i < strlen(ESSID); i++) {
    //if (!isprint (ESSID[i]))
    if (ESSID[i] < ' ') {
      ESSID[i] = '?';
      modified++;
    }
  }
  return modified;
}

void ProcessTagBits(UINT8 * packet, int len, int FrameType)
{
  static UINT8 NbTagSSID = 0;
  UINT8 *varBits;
  p80211_hdr_t *d80211b_Header;
  int tagType, tagLen;
  char Buff[0x101];             // BAD !!!
  UINT8 MaxSpeed, i;
  UINT8 NbCarCTRL = 0;          // Number of Control char is SSID 

  /* Get only that we want */
  //(UINT8 *) d80211b_Header = packet;
  //(UINT8 *) varBits = packet + sizeof(p80211_hdr_a3_t);
  d80211b_Header = (p80211_hdr_t *) packet;
  varBits = packet + sizeof(p80211_hdr_a3_t);

  /* Do a correction on the size of the Fixed Field and fill MacAdd */
  switch (FrameType) {
  case WLAN_FSTYPE_ASSOCREQ:
    break;
  case WLAN_FSTYPE_ASSOCRESP:
    break;
  case WLAN_FSTYPE_REASSOCREQ:
    break;
  case WLAN_FSTYPE_REASSOCRESP:
    break;
  case WLAN_FSTYPE_PROBEREQ:
    /* Size of FixedField = 0 */
    break;
  case WLAN_FSTYPE_PROBERESP:
    /* Size of FixedField = 0x0C */
    varBits += sizeof(FixedField_t);
    break;
  case WLAN_FSTYPE_BEACON:
    /* Size of FixedField = 0x0C */
    varBits += sizeof(FixedField_t);
    break;
  case WLAN_FSTYPE_ATIM:
    break;
  }
  NbTagSSID = 0;

  /* Get the tagged values 
   * There is a type and a length field
   * Followed by tha actual data 
   */

  tagType = 0;
  debug(1, "TagType(len) = ");

  /* -4 is the CRC, I don't want CRC :-)) */
  while ((varBits < (packet + len - 4)) && (tagType != 0xFF)) {

    tagType = varBits[0];
    tagLen = varBits[1];
    varBits += 2;
    debug(1, "%02d(%02d),", tagType, tagLen);
    switch (tagType) {

    case WLAN_EID_SSID:        /* 0 */
      //safe_strncpy (Res.SSID, varBits, tagLen);
      //safe_strncpy (Res.SSID, varBits, (tagLen <= 32) ? taglen : 32);
      memcpy(Res.SSID, varBits, (tagLen <= 32) ? tagLen : 32);

      //warning ("0> SSID = '%s'\n", Res.SSID);
      FilterESSID(Res.SSID);
      // Catch wellenreiter probes
      if (!strncmp(Res.SSID, "this_is_used_for_wellenreiter", 32)) {
        warning
            ("\nWARNING : Somebody use wellenreiter to probe SomeBody!\n");
      }
      // Catch Windows XP probes
      // Check some two or three think to find if it's a WinXP
      if (tagLen == 32) {
        for (i = 0; i < tagLen; i++) {
          if (varBits[i] < 32)
            NbCarCTRL++;
        }
        if (NbCarCTRL >= 4) {
          //warning ("WARNING : Windows XP is HERE !\n");
          safe_strncpy(Res.SSID, "<I'm a Buggy WinXP>", WLAN_SSID_MAXLEN);
        }
      }
      if ((tagLen == 0)
          && (FrameType == WLAN_FSTYPE_BEACON)) {
        safe_strncpy(Res.SSID, "<Hidden SSID>", WLAN_SSID_MAXLEN);
      }
      if ((tagLen != 0) && (varBits[0] == 0)
          && (varBits[1] == 0)
          && (varBits[2] == 0)) {
        // CISCO has this Bug : Send a Blank SSID but the length is not zeroized
        safe_strncpy(Res.SSID, "<Hidden SSID of known length>",
                     WLAN_SSID_MAXLEN);
      }
      LogPutSSID(d80211b_Header->a3.a2, d80211b_Header->a3.a3, Res.SSID);
      NbTagSSID++;
      break;

    case 50:                   /* 50 - Extended Supported Rates */
    case WLAN_EID_SUPP_RATES:  /*  1 - Supported Rates */
      MaxSpeed = (*varBits) & 0x7F;
      for (i = 0; i < tagLen; i++) {
        if (MaxSpeed < (*(varBits + i) & 0x7F))
          MaxSpeed = *(varBits + i) & 0x7F;
      }
      LogPutMaxSpeed(d80211b_Header->a3.a2, (UINT8) MaxSpeed);
      break;

    case WLAN_EID_FH_PARMS:    /* 2 */
      break;

    case WLAN_EID_DS_PARMS:    /* 3 */
      if (tagLen == 1) {
        Res.Channel = *varBits;
        LogPutChannel(d80211b_Header->a3.a2,
                      d80211b_Header->a3.a3, Res.Channel);
      }
      break;

    case WLAN_EID_CF_PARMS:    /* 4 */
      SET_TYPE_BIT_AP(Res.TypeOfClient);
      break;

    case WLAN_EID_TIM:         /* 5 */
      // The TIM information is only present within beacon frames generated by APs
      SET_TYPE_BIT_AP(Res.TypeOfClient);
      break;

    case WLAN_EID_IBSS_PARMS:  /* 6 */
      CLEAR_TYPE_BIT_AP(Res.TypeOfClient);
      SET_TYPE_BIT_P2P(Res.TypeOfClient);
      break;

    case WLAN_EID_CHALLENGE:   /* 16 */
      break;
      // Specific Vedor TAG

    case 7:                    /* Country Information */
      // Exemple : "FR ..." 0x46,0x52,0x20,0x0B,0x03,0x1E
      //            Country code en ASCII : FR
      //       Start channel      : 11
      //        Channels          :  3
      //         Max TX power     : 30 mW
      break;

    case 42:                   /* ERP Informations */
      break;

    case 133:                  /* CISCO */
      // It's an AP HOSTNAME, Thx for the information :-)
      safe_strncpy(Buff, (varBits + 0x0A), 0x10);
      UpdateOtherInformation(Buff);
      LogPutOtherInformation(d80211b_Header->a3.a2, Res.OtherInformation);
      break;

    case 171:                  /* Undocumented TAG - ARUBA */
      break;

    case 221:                  /* WPA or WME */
      safe_strncpy(Buff, "WPA or WME Capable", 12);
      UpdateOtherInformation(Buff);
      LogPutOtherInformation(d80211b_Header->a3.a2, Res.OtherInformation);
      AnalyseTAG221(d80211b_Header->a3.a3, varBits, tagLen);    // Analyse if for a BSSID
      break;

    case 0xFF:
      // End of Tag list
      break;
      // Other unknowned TAG
    default:
      snprintf(Buff, 32, "An unknow tag is detected : %02X", tagType);
      UpdateOtherInformation(Buff);
      LogPutOtherInformation(d80211b_Header->a3.a2, Res.OtherInformation);
      debug(1,
            "\nWARNING -- This TagType is unknowed =%02X\n"
            "Please send one of this packet to the author\n", tagType);
      break;
    }
    varBits += tagLen;
  }

  debug(1, "\nRes.TypeOfClient=%x\n", Res.TypeOfClient);

  if (NbTagSSID > 1) {
    // It seem to be a Windows XP STA :-)
    debug(1, "Tag 0 (SSID) is send more than one time (%d)\n", NbTagSSID);
    snprintf(Buff, 85,
             "Tag 0 (SSID) is send more than one time (%.2d) - "
             "This STA is probably under Windows XP", NbTagSSID);
    UpdateOtherInformation(Buff);
    LogPutOtherInformation(d80211b_Header->a3.a2, Res.OtherInformation);
  }
}

/* 
 * This function parse commandline and fill option ... 
 */
void ParseCommandLine(int argc, char **argv, ConfigStruct * config)
{
  int c, n;
  char *CommaPosition = NULL;

  int option_index = 0;
  static struct option long_options[] = {
    {"version", 0, 0, 'v'},
    {"help", 0, 0, 'h'},
    {"verbose", 1, 0, 'V'},
    {"output-file", 1, 0, 'F'},
    {"hop", 1, 0, 'H'},
    {"channel", 1, 0, 'S'},
    {"device-file", 1, 0, 'D'},
    {"computer-date", 0, 0, 'd'},
    {"iface", 1, 0, 'i'},
    {"pcapsrc", 1, 0, 'r'},
    {"ids", 0, 0, 'I'},
    {"max-packets", 1, 0, 'M'},
    {"hide-packets", 1, 0, 'N'},
    {"hop-delay", 1, 0, 't'},
    {"disable-check", 0, 0, 'c'},
    {"card-driver", 0, 0, 'C'},
#ifdef WITH_WIRETAP
    {"pcap-file", 1, 0, 'W'},
#endif
#ifdef WITH_SYSLOG
    {"send-to-syslog", 0, 0, 's'},
#endif
    {0, 0, 0, 0}
  };


  while ((c =
          getopt_long(argc, argv,
                      "vF:S:W:D:i:r:t:V:h?H:dM:N:IG:w:k:C:cs",
                      long_options, &option_index)) != EOF) {

    switch (c) {
      // Set channel
    case 'S':
      config->SingleChannel = atoi(optarg);
      if (config->SingleChannel < CHANNEL_MIN ||
          config->SingleChannel > CHANNEL_MAX) {
        fprintf(stderr,
                "Error : Channel must be between %d and %d\n",
                CHANNEL_MIN, CHANNEL_MAX);
        Bye(ERROR_CHANNEL_OUT_OF_BOUND);
      }
      break;

#ifdef WITH_SYSLOG
      // Send Alert to Syslog
    case 's':
      config->SendAlert2Syslog = TRUE;
      openlog("wifiscanner", LOG_ODELAY || LOG_PID, LOG_USER);
      break;
#endif

      // Output file for real time information
    case 'F':
      if (strncmp("auto", optarg, 5)) {
        config->OutFileName = optarg;
      } else {

      }
      break;

      // PCAP output
#ifdef WITH_WIRETAP
    case 'W':                  // PCAP output file
      config->OutDumpFileName = optarg;
      break;
#endif

      // .DOT output
    case 'D':
      config->OutDotFileName = optarg;
      break;

    case 'r':
      config->InPcapFileName = optarg;
      break;

      // Version
    case 'v':
      Bye(NO_ERROR);
      break;

      // Number of Hop for channel rotation
    case 'H':
      config->ChannelHop = atoi(optarg);
      if (config->ChannelHop < HOP_MIN || config->ChannelHop > HOP_MAX) {
        fprintf(stderr,
                "Error : Hop must be between %d and %d\n",
                HOP_MIN, HOP_MAX);
        Bye(ERROR_HOP_OUT_OF_BOUND);
      }
      break;

      // Verbosity level
    case 'V':
      config->DebugLevel = atoi(optarg);
      if (config->DebugLevel < 1 || config->DebugLevel > MAX_DEBUG_LEVEL)
        config->DebugLevel = MAX_DEBUG_LEVEL;
      n = 0;                    // Display all packets
      break;

      // Time to sleep before change channel
    case 't':
      config->TimeToSleepBeforeChangeChannel = atoi(optarg);
      if (config->TimeToSleepBeforeChangeChannel < 1
          || config->TimeToSleepBeforeChangeChannel > 10000)
        config->TimeToSleepBeforeChangeChannel = 10000; /* Ten seconds is enougth */
      break;

      // Choice of interface
    case 'i':
      // The interface can be "eth0" or "eth1,wifi0"
      // So we search the comma
      if (strlen(optarg) > (DEVNAME_LEN * 2 + 1)) {
        // Hmmm What did the user want ...
        fprintf(stderr,
                "I think that the length of the interface is a little bit too long\n"
                " Wake up ! And don't sleep on your keyboard !   :)\n");
        Bye(ERROR_DONT_TRY_TO_SLEEP_ON_THE_KEYBOARD);
      }
      memset(config->devname, 0, DEVNAME_LEN);
      memset(config->devname2, 0, DEVNAME_LEN);
      CommaPosition = strchr(optarg, ',');
      if (CommaPosition == NULL) {
        // Only one interface
        safe_strncpy(config->devname, optarg, DEVNAME_LEN);
        config->devname[DEVNAME_LEN - 1] = '\0';
        debug(3, "Only one interface is given : %s\n", config->devname);
      } else {
        UINT16 SizeOne, SizeTwo;
        SizeOne = CommaPosition - optarg;
        SizeTwo = strlen(optarg) - SizeOne;
        safe_strncpy(config->devname, optarg, SizeOne + 1);
        safe_strncpy(config->devname2, (CommaPosition + 1), SizeTwo);
        debug(3, "Two interface is given : (%s)[%d]-(%s)[%d]\n",
              config->devname, SizeOne, config->devname2, SizeTwo);
      }
      if (InterfaceIsExistant(config->devname) == FALSE) {
        fprintf(stderr, "Arg, the interface %s is not existant\n",
                config->devname);
        Bye(ERROR_UNKNOWN_INTERFACE);
      }
      break;

      // Human readable date
    case 'd':
      config->DateFormat = 0;
      break;

      // Max packets to capture before leave
    case 'M':
      // Check if outbound
      if (atol(optarg) < 0)
        config->MaxPacket = atol(optarg);
      break;

      // IDS 
    case 'I':
      config->IDS_is_ON = TRUE;
      //*OutIDSFileName = optarg;
      break;

      // Hide some packets (only on display)
    case 'N':
      n = 0;
      fprintf(stdout, "Do not display: ");
      // do while until end of option or 16 sub-option ...
      while ((optarg[n] != 0) && (n < 16)) {
        switch (optarg[n]) {
        case 'A':
        case 'a':
          SET_BIT(config->DoNotDisplay, DISPLAY_ACK_BIT);
          fprintf(stdout, "ACK ");
          break;
        case 'B':
        case 'b':
          SET_BIT(config->DoNotDisplay, DISPLAY_BEACON_BIT);
          fprintf(stdout, "BEACON ");
          break;
        case 'C':
        case 'c':
          SET_BIT(config->DoNotDisplay, DISPLAY_CONTROL_BIT);
          fprintf(stdout, "CONTROL ");
          break;
        case 'D':
        case 'd':
          SET_BIT(config->DoNotDisplay, DISPLAY_DATA_BIT);
          fprintf(stdout, "DATA ");
          break;
        case 'P':
        case 'p':
          SET_BIT(config->DoNotDisplay, DISPLAY_PROBE_BIT);
          fprintf(stdout, "PROBE ");
          break;
        case 'S':
        case 's':
          SET_BIT(config->DoNotDisplay, DISPLAY_STATION_BIT);
          fprintf(stdout, "STATION ");
          break;
        default:
          break;
        }
        n++;
      }
      fprintf(stdout, "\n");
      if (config->DebugLevel > 1) {
        fprintf(stdout,
                "Verbose level is more than 1 so all packets are display\n");
      }
      break;

      // G option
    case 'G':                  // ???
      break;

      // Save weak packets
    case 'w':
      break;

      // Save KeyStream of Authen with IV
    case 'k':
      break;

      // Card driver
    case 'C':                  // Choice of CARD
      if ((!strcmp(optarg, "prism"))
          || (!strcmp(optarg, "hostap"))
          || (!strcmp(optarg, "cisco"))
          || (!strcmp(optarg, "cisco_wifi"))
          || (!strcmp(optarg, "orinoco"))
          || (!strcmp(optarg, "prism54g"))
          || (!strcmp(optarg, "airjack"))
          || (!strcmp(optarg, "ipw2100"))
          || (!strcmp(optarg, "ipw2200"))
          || (!strcmp(optarg, "madwifi-ng"))
/*          || (!strcmp(optarg, "pcap")) */
          || (!strcmp(optarg, "atheros"))) {
        if (!strcmp(optarg, "cisco_wifi")) {
          config->TypeOfCard = CISCO_CVS_CARD;
          fprintf(stderr,
                  "\n##############\n"
                  " WARNING - I'm absolutly not sure that this driver work correctly (ALPHA VERSION)\n"
                  "##############\n\n");
          sleep(5);
        }
        if (!strcmp(optarg, "cisco")) {
          config->TypeOfCard = CISCO_CARD;
        }
        if (!strcmp(optarg, "prism")) {
          config->TypeOfCard = WLAN_NG_CARD;
        }
        if (!strcmp(optarg, "prism54g")) {
          config->TypeOfCard = PRISM54G_CARD;
        }
        if (!strcmp(optarg, "hostap")) {
          config->TypeOfCard = HOSTAP_CARD;
        }
        if (!strcmp(optarg, "atheros")) {
          config->TypeOfCard = ATHEROS_CARD;
        }
        if (!strcmp(optarg, "madwifi-ng")) {
          config->TypeOfCard = MADWIFI_NG_CARD;
        }
        if (!strcmp(optarg, "orinoco")) {
          config->TypeOfCard = LUCENT_CARD;
        }
        if (!strcmp(optarg, "ipw2100")) {
          config->TypeOfCard = IPW_CARD;
        }
        if (!strcmp(optarg, "ipw2200")) {
          config->TypeOfCard = IPW_CARD;
        }
        if (!strcmp(optarg, "pcap")) {
          // XXX : NOT NOW SUPPORTED 
          config->TypeOfCard = PCAP_VIRTUAL_CARD;
        }
        if (!strcmp(optarg, "airjack")) {
          config->TypeOfCard = AIRJACK_CARD;
        }
      } else {
        fprintf(stderr,
                "Only 'prism', 'cisco' 'cisco_wifi (eth+wifi)' 'orinoco' 'atheros', 'prism54g',\n"
                " 'airjack', 'ipw2200', 'ipw2100', 'hostap', 'madwifi-ng' or 'pcap' card is allowed.\n");
        Bye(ERROR_UNKNOWN_INTERFACE_TYPE);
      }
      debug(2, "Driver used is : %s\n", optarg);
      break;
      // Disable curses checks
    case 'c':
      config->CheckScreenSize = FALSE;
      break;

      // Help 
    case '?':                  // Help
    case 'h':                  // Help too
      HelpAndBye();
      break;

      // Default
    default:
      HelpAndBye();
      break;
    }
  }

  // Post analyse of parameters
  if ((config->TypeOfCard == CISCO_CVS_CARD)
      && (!strcmp(config->devname2, ""))) {
    fprintf(stderr,
            "You must give me two interface, when card driver is cisco_wifi"
            "like -i eth1,wifi0\n");
    Bye(ERROR_BAD_PARAMETER);
  }
  if ((config->TypeOfCard == PCAP_VIRTUAL_CARD)
      && (!strcmp(config->InPcapFileName, ""))) {
    fprintf(stderr,
            "You must give me a PCAP source file, when card driver is PCAP\n");
    Bye(ERROR_MISSING_PCAP_FILE);
  }

}



/*
 * Summerize configuration
 */

void DispConf(ConfigStruct * config)
{

  if (config->TypeOfCard == CISCO_CVS_CARD) {
    fprintf(stdout, "Interfaces used: %s and %s \n", config->devname,
            config->devname2);
    if (InterfaceIsExistant(config->devname2) == FALSE) {
      fprintf(stderr, "Arg, the interface %s is not existant\n",
              config->devname2);
      Bye(ERROR_UNKNOWN_INTERFACE);
    }
  } else {
    fprintf(stdout, "Interface used: %s\n", config->devname);
  }
  if (InterfaceIsExistant(config->devname) == FALSE) {
    fprintf(stderr, "Arg, the interface %s is not existant\n",
            config->devname);
    Bye(ERROR_UNKNOWN_INTERFACE);
  }

  fprintf(stdout, "Debug Level: %d", config->DebugLevel);
  if (config->DebugLevel == MAX_DEBUG_LEVEL)
    fprintf(stdout, " (Crazy level)");
  // Out Files
  fprintf(stdout, "\nOutput filename: %s",
          (config->OutFileName == NULL) ? "<none>" : config->OutFileName);
  fprintf(stdout, "\nPCap dump file: %s",
          (config->OutDumpFileName ==
           NULL) ? "<none>" : config->OutDumpFileName);
  fprintf(stdout, "\nDot output filename: %s",
          (config->OutDotFileName ==
           NULL) ? "<none>" : config->OutDotFileName);

  fprintf(stdout, "\nChannel scan : %d", config->SingleChannel);
  if (config->SingleChannel == 0)
    fprintf(stdout, " (All channels)");
  fprintf(stdout, "\nSleep between channel hop: %d",
          config->TimeToSleepBeforeChangeChannel);

  fprintf(stdout, "\nMax packets before quit: %d",
          (int) config->MaxPacket);
  if (!config->MaxPacket)
    fprintf(stdout, " (Don't quit)");
  fprintf(stdout, "\nDate format: %s",
          (config->DateFormat) ? "Timestamp" : "Human readable");
  fprintf(stdout, "\nCurses Screen size detection: %s",
          (config->CheckScreenSize) ? "Enabled" : "Disabled");
  fprintf(stdout, "\nIDS active: %s",
          (config->IDS_is_ON) ? "Enabled" : "Disabled");
  fprintf(stdout, "\nSend IDS alert to Syslog: %s\n",
          (config->SendAlert2Syslog) ? "Enabled" : "Disabled");

// Add channels per second scan info.
}



void ChannelToStr(char *strChannel, UINT8 Channel, UINT8 SChannel)
{
  if (Channel == 0) {
    sprintf(strChannel, "%02d(%02d)", Channel, SChannel);
  } else {
    sprintf(strChannel, "%02d(%+02d)", Channel, Channel - SChannel);
  }
  debug(1, "S-C=%02d-%02d\n", Channel, SChannel);
}

/***
 * Initialisation of Configuration
 ***/
void InitConfiguration(ConfigStruct * config)
{
  // Configuration declaration
  config->SingleChannel = (UINT8) 0;
  //config->TimeToSleepBeforeChangeChannel = TIME_TO_SLEEP_BEFORE_CHANGE_CHANNEL;
  config->TimeToSleepBeforeChangeChannel = 200; // in ms
  config->DebugLevel = (UINT8) 0;
  config->ChannelHop = (UINT8) 5;
  config->DateFormat = (UINT8) 1;       // 1 is human readable
  strcpy(config->devname, "wlan0");
  config->TypeOfCard = WLAN_NG_CARD;
  config->CheckScreenSize = TRUE;
  config->SendAlert2Syslog = FALSE;
  config->JammingNow = FALSE;
  config->DoNotDisplay = (UINT8) 0;     // 0000 0000
  //                                         || |||\_Ack
  //                                         || ||\__Beacon
  //                                         || |\___Control
  //                                         || \____Data
  //                                         |\______Probe
  //                                         \_______Station
}


/*
 * Extract radiotap data from radiotap field
 *  code was get from tcpdump
 */
/*
 * Copyright (c) 2001
 *      Fortress Technologies, Inc.  All rights reserved.
 *      Charlie Lenahan (clenahan@fortresstech.com)
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that: (1) source code distributions
 * retain the above copyright notice and this paragraph in its entirety, (2)
 * distributions including binary code include the above copyright notice and
 * this paragraph in its entirety in the documentation or other materials
 * provided with the distribution, and (3) all advertising materials mentioning
 * features or use of this software display the following acknowledgement:
 * ``This product includes software developed by the University of California,
 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
 * the University nor the names of its contributors may be used to endorse
 * or promote products derived from this software without specific prior
 * written permission.
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 */

int extract_radiotap_field(struct cpack_state *s, u_int32_t bit,
                           p80211_caphdr_t * wlan_header)
{
  union {
    int8_t i8;
    u_int8_t u8;
    int16_t i16;
    u_int16_t u16;
    int32_t i32;
    u_int32_t u32;
    u_int64_t u64;
  } u, u2;
  int rc;
  UINT16 temp;

  switch (bit) {
  case IEEE80211_RADIOTAP_FLAGS:
  case IEEE80211_RADIOTAP_RATE:
  case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
  case IEEE80211_RADIOTAP_DB_ANTNOISE:
  case IEEE80211_RADIOTAP_ANTENNA:
    rc = cpack_uint8(s, &u.u8);
    break;
  case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
  case IEEE80211_RADIOTAP_DBM_ANTNOISE:
    rc = cpack_int8(s, &u.i8);
    break;
  case IEEE80211_RADIOTAP_CHANNEL:
    rc = cpack_uint16(s, &u.u16);
    if (rc != NO_ERROR)
      break;                    // stop analyse if the first 16bits was not OK
    rc = cpack_uint16(s, &u2.u16);
    break;
  case IEEE80211_RADIOTAP_FHSS:
  case IEEE80211_RADIOTAP_LOCK_QUALITY:
  case IEEE80211_RADIOTAP_TX_ATTENUATION:
    rc = cpack_uint16(s, &u.u16);
    break;
  case IEEE80211_RADIOTAP_DB_TX_ATTENUATION:
    rc = cpack_uint8(s, &u.u8);
    break;
  case IEEE80211_RADIOTAP_DBM_TX_POWER:
    rc = cpack_int8(s, &u.i8);
    break;
  case IEEE80211_RADIOTAP_TSFT:
    rc = cpack_uint64(s, &u.u64);
    break;
  default:
    /* this bit indicates a field whose
     * size we do not know, so we cannot
     * proceed.
     */
    warning("A field in RadioTap data was not know, we skip it\n");
    return -1;
  }

  // --------------
  if (rc != NO_ERROR) {
    warning("Extraction of data from RadioTap was not success\n");
    return rc;
  }
  // --------------

  switch (bit) {
  case IEEE80211_RADIOTAP_CHANNEL:
    if (u2.u16 & IEEE80211_CHAN_2GHZ) {  /* 2GHz band */
      if (u.u16 == 2484)
        wlan_header->channel = 14;
      if (u.u16 < 2484)
        wlan_header->channel = (u.u16 - 2407) / 5;
      else
        wlan_header->channel = 15 + ((u.u16 - 2512) / 20);
    } else if (u2.u16 & IEEE80211_CHAN_5GHZ) {   /* 5Ghz band */
      wlan_header->channel = (u.u16 - 5000) / 5;
    } else {                    /* either, try to guess */
      if (u.u16 == 2484)
        wlan_header->channel = 14;
      if (u.u16 < 2484)
        wlan_header->channel = (u.u16 - 2407) / 5;
      if (u.u16 < 5000)
        wlan_header->channel = 15 + ((u.u16 - 2512) / 20);
      wlan_header->channel = (u.u16 - 5000) / 5;
    }
    debug(1, "IEEE80211_RADIOTAP_CHANNEL : %d (%04d Mhz / %04X )\n", wlan_header->channel, u.u16, u2.u16);
    break;
  case IEEE80211_RADIOTAP_FHSS:
    // Not analyzed
    break;
  case IEEE80211_RADIOTAP_RATE:
    wlan_header->datarate = u.u8;
    wlan_header->datarate = wlan_header->datarate * 5;  // my datarate is in units of 100kbps.
    debug(3, "IEEE80211_RADIOTAP_RATE : %X\n", wlan_header->datarate);
    break;
  case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
    if (u.i8 != 0) {
      wlan_header->ssi_signal = 200 + u.i8;
    }
    //warning (">> wlan_header->ssi_signal = %d\n", wlan_header->ssi_signal);
    debug(3, "IEEE80211_RADIOTAP_DBM_ANTSIGNAL : %d dB signal\n",
          wlan_header->ssi_signal);
    break;
  case IEEE80211_RADIOTAP_DBM_ANTNOISE:
    if (u.i8 != 0) {
      wlan_header->ssi_noise = 200 + u.i8;
    }
    debug(3, "IEEE80211_RADIOTAP_DBM_ANTNOISE : %d dB noise\n",
          wlan_header->ssi_noise);
    break;
  case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
    // Not analyzed
    break;
  case IEEE80211_RADIOTAP_DB_ANTNOISE:
    // Not analyzed
    break;
  case IEEE80211_RADIOTAP_LOCK_QUALITY:
    // Not analyzed
    debug(3, "IEEE80211_RADIOTAP_LOCK_QUALITY : %d sq\n", u.u16);
    break;
  case IEEE80211_RADIOTAP_TX_ATTENUATION:
    // Not analyzed
    debug(3, "IEEE80211_RADIOTAP_TX_ATTENUATION : %d tx power\n",
          -(int) u.u16);
    break;
  case IEEE80211_RADIOTAP_DB_TX_ATTENUATION:
    // Not analyzed
    debug(3, "IEEE80211_RADIOTAP_DB_TX_ATTENUATION : %d tx power\n",
          -(int) u.u8);
    break;
  case IEEE80211_RADIOTAP_DBM_TX_POWER:
    // Not analyzed
    debug(3, "IEEE80211_RADIOTAP_DBM_TX_POWER : %d tx power\n", u.i8);
    break;
  case IEEE80211_RADIOTAP_FLAGS:
    debug(3, "IEEE80211_RADIOTAP_FLAGS: ");
    if (u.u8 & IEEE80211_RADIOTAP_F_CFP)
      debug(3, "cfp ");
    if (u.u8 & IEEE80211_RADIOTAP_F_SHORTPRE)
      debug(3, "short preamble ");
    if (u.u8 & IEEE80211_RADIOTAP_F_WEP)
      debug(3, "wep ");
    if (u.u8 & IEEE80211_RADIOTAP_F_FRAG)
      debug(3, "fragmented ");
    if (u.u8 & IEEE80211_RADIOTAP_F_BADFCS)
      debug(3, "bad-fcs ");
    debug(3, "\n");
    break;
  case IEEE80211_RADIOTAP_ANTENNA:
    wlan_header->antenna = u.u8;
    debug(3, "IEEE80211_RADIOTAP_ANTENNA : %d\n", u.u8);
    break;
  case IEEE80211_RADIOTAP_TSFT:
    wlan_header->mactime = u.u64;
    debug(3, "IEEE80211_RADIOTAP_TSFT : %llX us tsft \n", u.u64);
    break;
  default:
    warning("A field in RadioTap data was not know, we skip it\n");
    break;
  }
  // warning("wlan_header->ssi_signal = %d\n", wlan_header->ssi_signal);
  return NO_ERROR;
}


/***
 * Fill Radio data in depend of DataLink
 * return the real size of the header
 ***/
int FillRadioData(p80211_caphdr_t * wlan_header, int DataLink,
                  UINT8 * Packet, int len)
{
  p80211msg_lnxind_wlansniffrm_t *Sniff_Frame;
  p80211_caphdr_t *AVS_data;
  struct ieee80211_radiotap_header *radiotap_hdr;

  int real_size_of_headers = 0;

  // init all data to Zero, and after we fill with the good data
  wlan_header->version = 0;
  wlan_header->length = 0;
  wlan_header->mactime = 0;
  wlan_header->hosttime = 0;
  wlan_header->phytype = 0;
  wlan_header->channel = 0;
  wlan_header->datarate = 0;
  wlan_header->antenna = 0;
  wlan_header->priority = 0;
  wlan_header->ssi_type = 0;
  wlan_header->ssi_signal = 0;
  wlan_header->ssi_noise = 0;
  wlan_header->preamble = 0;
  wlan_header->encoding = 0;

  switch (DataLink) {
  case DLT_PRISM_HEADER:
    Sniff_Frame = (p80211msg_lnxind_wlansniffrm_t *) Packet;
    wlan_header->mactime = Sniff_Frame->mactime.data;
    wlan_header->hosttime = Sniff_Frame->hosttime.data;
    wlan_header->phytype = phytype_dsss_dot11_b;        // Not used for now
    wlan_header->channel = Sniff_Frame->channel.data;
    wlan_header->datarate = Sniff_Frame->rate.data * 5; // datarate is in units of 100kbps.
    wlan_header->ssi_signal = Sniff_Frame->signal.data;
    wlan_header->ssi_noise = Sniff_Frame->noise.data;
    real_size_of_headers = sizeof(p80211msg_lnxind_wlansniffrm_t);
    break;
  case DLT_IEEE802_11_RADIO_AVS:
    AVS_data = (p80211_caphdr_t *) Packet;
    wlan_header->version = AVS_data->version;
    wlan_header->length = AVS_data->length;
    wlan_header->mactime = AVS_data->mactime;
    wlan_header->hosttime = AVS_data->hosttime;
    wlan_header->phytype = AVS_data->phytype;
    wlan_header->channel = AVS_data->channel;
    wlan_header->datarate = AVS_data->datarate;
    wlan_header->antenna = AVS_data->antenna;
    wlan_header->priority = AVS_data->priority;
    wlan_header->ssi_type = AVS_data->ssi_type;
    wlan_header->ssi_signal = AVS_data->ssi_signal;
    wlan_header->ssi_noise = AVS_data->ssi_noise;
    wlan_header->preamble = AVS_data->preamble;
    wlan_header->encoding = AVS_data->encoding;
    real_size_of_headers = sizeof(p80211_caphdr_t);
    break;
  case DLT_IEEE802_11_RADIO:
    {
#define BITNO_32(x) (((x) >> 16) ? 16 + BITNO_16((x) >> 16) : BITNO_16((x)))
#define BITNO_16(x) (((x) >> 8) ? 8 + BITNO_8((x) >> 8) : BITNO_8((x)))
#define BITNO_8(x) (((x) >> 4) ? 4 + BITNO_4((x) >> 4) : BITNO_4((x)))
#define BITNO_4(x) (((x) >> 2) ? 2 + BITNO_2((x) >> 2) : BITNO_2((x)))
#define BITNO_2(x) (((x) & 2) ? 1 : 0)
#define BIT(n)  (1 << n)
#define IS_EXTENDED(__p)        \
                  (EXTRACT_LE_32BITS(__p) & BIT(IEEE80211_RADIOTAP_EXT)) != 0
      int bit0;
      enum ieee80211_radiotap_type bit;
      struct cpack_state cpacker;
      u_int32_t present, next_present;
      u_int32_t *presentp, *last_presentp;
      UINT8 exit_loop = FALSE;
      const u_char *iter;

      // Exemple : 0000 1000 2E08 0000 0002 9409 A000 C802
      radiotap_hdr = (struct ieee80211_radiotap_header *) Packet;
      //data_pt = Packet + sizeof(struct ieee80211_radiotap_header);

      real_size_of_headers = radiotap_hdr->it_len;

      debug(3, "radiotap_hdr->it_len = %02X\n", radiotap_hdr->it_len);

#if 0
      DumpHexPaquets(RealTime_WND, Packet, radiotap_hdr->it_len);
      DumpHexPaquets(RealTime_WND, Packet + radiotap_hdr->it_len, len);
#endif

      for (last_presentp = &radiotap_hdr->it_present;
           IS_EXTENDED(last_presentp)
           && (u_char *) (last_presentp + 1) <= Packet + len; last_presentp++);
      {
      }

      iter = (u_char *) (last_presentp + 1);

      if (cpack_init(&cpacker, (u_int8_t *) iter, len - (iter - Packet)) == 0) {

        if (IS_BIT_SET(radiotap_hdr->it_present, IEEE80211_RADIOTAP_EXT)) {
          warning
              ("Radiotap use an extended data, please send mail to the developper to notify this problem\n");
        } else {
          for (bit0 = 0, presentp = &radiotap_hdr->it_present;
               presentp <= last_presentp; presentp++, bit0 += 32) {
            for (present = EXTRACT_LE_32BITS(presentp); present;
                 present = next_present) {
              /* clear the least significant bit that is set */
              next_present = present & (present - 1);
              /* extract the least significant bit that is set */
              bit = (enum ieee80211_radiotap_type) (bit0 + BITNO_32(present ^ next_present)); 

              if (extract_radiotap_field(&cpacker, bit, wlan_header) != NO_ERROR) {
                exit_loop = TRUE;
                break;
              }
            }
            if (exit_loop == TRUE)
              break;
          }
        }
      }
#undef BITNO_32
#undef BITNO_16
#undef BITNO_8
#undef BITNO_4
#undef BITNO_2
#undef BIT
#undef IS_EXTENDED
    }
    break;
  default:
    break;
  }
  return real_size_of_headers;
}

int CalculateOffset(int DataLink)
{
  int offset = 0;

  switch (DataLink) {
  case DLT_PRISM_HEADER:
    debug(2, "pcap_datalink(ca.pcap) = %d = DLT_PRISM_HEADER\n", DataLink);
    offset = 0x90;
    break;
  case DLT_IEEE802_11:
    debug(2, "pcap_datalink(ca.pcap) = %d = DLT_IEEE802_11\n", DataLink);
    offset = 0x00;
    break;
  case DLT_AIRONET_HEADER:
    debug(2, "pcap_datalink(ca.pcap) = %d = DLT_AIRONET_HEADER:\n",
          DataLink);
    offset = 0x00;
    break;
  case DLT_LINUX_SLL:          //113
    debug(2, "pcap_datalink(ca.pcap) = %d = DLT_LINUX_SLL\n", DataLink);
    offset = 0x10;
    break;
  case DLT_IEEE802_11_RADIO:   //127
    debug(2, "pcap_datalink(ca.pcap) = %d = DLT_IEEE802_11_RADIO\n",
          DataLink);
    offset = 0x10;
    // ofset is calculate directly by the extract function
    break;
  case DLT_IEEE802_11_RADIO_AVS:       //163
    debug(2, "pcap_datalink(ca.pcap) = %d = DLT_IEEE802_11_RADIO_AVS\n",
          DataLink);
    offset = 0x40;
    break;
  default:                     //COOKED
    debug(2, "pcap_datalink(ca.pcap) = %d = Default to COOKED\n",
          DataLink);
    offset = 0x10;
  }
  return offset;
}

---